General

  • Target

    IMG_20230516_073222.jpg

  • Size

    218KB

  • Sample

    230602-qlks6abe67

  • MD5

    8598b35f0761b67743707f700f2fce3f

  • SHA1

    f0cff7f09ebc1ecfaf83972f1dc09e5ae63f2f85

  • SHA256

    4ca41e28de4bc71f094ceb83f208c33103130bff2f0e250a88f4f925bb232ea4

  • SHA512

    1fe1e6190742de627055d975449c4da4c2bd13ba5d5f5d408ae424e233b9894281848d1444b955c606dcb653d5c9a300080ff5b4fa5e1ef1d9095c9c22626cce

  • SSDEEP

    6144:/G/Lf6c581nvJkoeRE4YQIv7iQuLTJOmyj37cU3:/0rULkvREGIv7zWTJOh37

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      IMG_20230516_073222.jpg

    • Size

      218KB

    • MD5

      8598b35f0761b67743707f700f2fce3f

    • SHA1

      f0cff7f09ebc1ecfaf83972f1dc09e5ae63f2f85

    • SHA256

      4ca41e28de4bc71f094ceb83f208c33103130bff2f0e250a88f4f925bb232ea4

    • SHA512

      1fe1e6190742de627055d975449c4da4c2bd13ba5d5f5d408ae424e233b9894281848d1444b955c606dcb653d5c9a300080ff5b4fa5e1ef1d9095c9c22626cce

    • SSDEEP

      6144:/G/Lf6c581nvJkoeRE4YQIv7iQuLTJOmyj37cU3:/0rULkvREGIv7zWTJOh37

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Downloads MZ/PE file

    • Modifies file permissions

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Command and Control

Web Service

1
T1102

Tasks