Resubmissions

14-04-2023 14:41

230414-r2x9vsbg51 10

14-04-2023 09:35

230414-lkb3eaag51 1

13-04-2023 17:57

230413-wj3tvadb67 10

13-04-2023 15:30

230413-sxtasadf7v 10

10-02-2023 19:20

230210-x2eqeagd91 10

29-01-2023 00:49

230129-a6f3pshb27 10

28-01-2023 23:56

230128-3y9dhagh93 10

23-01-2023 04:57

230123-flqz3add9z 10

General

  • Target

    Word.exe

  • Size

    3MB

  • Sample

    230413-sxtasadf7v

  • MD5

    e8340564caba7a2635af2c79cb7103eb

  • SHA1

    8c62c79508abe5ffa36608d1846dcb20b2a27137

  • SHA256

    acd5f35bfcc91c197d8ea08afe588454233114500255ed842b0589dc194ec466

  • SHA512

    b6dc6dfeff210222ee904ad9c8dc832e4bf9c27a84298d2817e320bd9308e6d647a5efcf6845a0ed2b0cebdb6539257cd07428bbdce3d5d5db23e8614503d9d2

  • SSDEEP

    98304:/uWtmPx3xiobns6osz1gyQ4BL995Bt9JWpVi6q:/9m5hi0HBtQ4P95L9g3i6q

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      Word.exe

    • Size

      3MB

    • MD5

      e8340564caba7a2635af2c79cb7103eb

    • SHA1

      8c62c79508abe5ffa36608d1846dcb20b2a27137

    • SHA256

      acd5f35bfcc91c197d8ea08afe588454233114500255ed842b0589dc194ec466

    • SHA512

      b6dc6dfeff210222ee904ad9c8dc832e4bf9c27a84298d2817e320bd9308e6d647a5efcf6845a0ed2b0cebdb6539257cd07428bbdce3d5d5db23e8614503d9d2

    • SSDEEP

      98304:/uWtmPx3xiobns6osz1gyQ4BL995Bt9JWpVi6q:/9m5hi0HBtQ4P95L9g3i6q

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks