General

  • Target

    xfbbxf.txt

  • Size

    11B

  • Sample

    240222-t5mnmsda22

  • MD5

    a7f88aebb38e4e7d672cb999ff70c19b

  • SHA1

    62921eca960b42229347e3c1eee19ac909bda43c

  • SHA256

    86a2cd089f59025e0c57d2a21cc4f062c234d863bbbeef1dbfc3aa18556e06e8

  • SHA512

    e78473801d916f180cf81af0e9f621fe632a1bafe3150d13eac97101057f27897e140a12a6246c4d817ba2b2015b2da7bfc846b5923e3d3fd085761eb6fdd40c

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      xfbbxf.txt

    • Size

      11B

    • MD5

      a7f88aebb38e4e7d672cb999ff70c19b

    • SHA1

      62921eca960b42229347e3c1eee19ac909bda43c

    • SHA256

      86a2cd089f59025e0c57d2a21cc4f062c234d863bbbeef1dbfc3aa18556e06e8

    • SHA512

      e78473801d916f180cf81af0e9f621fe632a1bafe3150d13eac97101057f27897e140a12a6246c4d817ba2b2015b2da7bfc846b5923e3d3fd085761eb6fdd40c

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks