Resubmissions
14-04-2023 14:41
230414-r2x9vsbg51 1014-04-2023 09:35
230414-lkb3eaag51 113-04-2023 17:57
230413-wj3tvadb67 1013-04-2023 15:30
230413-sxtasadf7v 1010-02-2023 19:20
230210-x2eqeagd91 1029-01-2023 00:49
230129-a6f3pshb27 1028-01-2023 23:56
230128-3y9dhagh93 1023-01-2023 04:57
230123-flqz3add9z 10General
-
Target
Word.exe
-
Size
3MB
-
Sample
230210-x2eqeagd91
-
MD5
e8340564caba7a2635af2c79cb7103eb
-
SHA1
8c62c79508abe5ffa36608d1846dcb20b2a27137
-
SHA256
acd5f35bfcc91c197d8ea08afe588454233114500255ed842b0589dc194ec466
-
SHA512
b6dc6dfeff210222ee904ad9c8dc832e4bf9c27a84298d2817e320bd9308e6d647a5efcf6845a0ed2b0cebdb6539257cd07428bbdce3d5d5db23e8614503d9d2
-
SSDEEP
98304:/uWtmPx3xiobns6osz1gyQ4BL995Bt9JWpVi6q:/9m5hi0HBtQ4P95L9g3i6q
Static task
static1
Behavioral task
behavioral1
Sample
Word.exe
Resource
win10-20220901-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
Word.exe
-
Size
3MB
-
MD5
e8340564caba7a2635af2c79cb7103eb
-
SHA1
8c62c79508abe5ffa36608d1846dcb20b2a27137
-
SHA256
acd5f35bfcc91c197d8ea08afe588454233114500255ed842b0589dc194ec466
-
SHA512
b6dc6dfeff210222ee904ad9c8dc832e4bf9c27a84298d2817e320bd9308e6d647a5efcf6845a0ed2b0cebdb6539257cd07428bbdce3d5d5db23e8614503d9d2
-
SSDEEP
98304:/uWtmPx3xiobns6osz1gyQ4BL995Bt9JWpVi6q:/9m5hi0HBtQ4P95L9g3i6q
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix
Collection
Data from Local System
1Command and Control
Credential Access
Credentials in Files
1Defense Evasion
File Deletion
2Modify Registry
3Hidden Files and Directories
1File Permissions Modification
1Execution
Exfiltration
Initial Access
Lateral Movement
Privilege Escalation