General
-
Target
BTC Transacciones.exe
-
Size
3MB
-
Sample
230123-gfxq4abg79
-
MD5
bc5ee0bcefce9d21f9a17c60a19c2b18
-
SHA1
6b207ad03911865694e5f4c3059c2a5f0242c6da
-
SHA256
6b89421aeeac6f26e6f50749e52867082295767e13f059aaed031821d05da50e
-
SHA512
19534783f60117864065d402caa46808e8dadad2f1fb43ac4b28990ab863ea9eae894fb646359e25db007bcbcf5a7d506cb801de2ed81b2afbf0f2156d6a751f
-
SSDEEP
98304:iuWimPx3xiobns6osz1gyQ4BL995Bt9JWpViAG:iym5hi0HBtQ4P95L9g3i7
Static task
static1
Behavioral task
behavioral1
Sample
BTC Transacciones.exe
Resource
win10-20220812-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
BTC Transacciones.exe
-
Size
3MB
-
MD5
bc5ee0bcefce9d21f9a17c60a19c2b18
-
SHA1
6b207ad03911865694e5f4c3059c2a5f0242c6da
-
SHA256
6b89421aeeac6f26e6f50749e52867082295767e13f059aaed031821d05da50e
-
SHA512
19534783f60117864065d402caa46808e8dadad2f1fb43ac4b28990ab863ea9eae894fb646359e25db007bcbcf5a7d506cb801de2ed81b2afbf0f2156d6a751f
-
SSDEEP
98304:iuWimPx3xiobns6osz1gyQ4BL995Bt9JWpViAG:iym5hi0HBtQ4P95L9g3i7
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-