General

  • Target

    2024-03-06_e396682fa41f62fc399419848377f59f_destroyer_wannacry

  • Size

    22KB

  • Sample

    240306-wn6fjaef25

  • MD5

    e396682fa41f62fc399419848377f59f

  • SHA1

    69e6c685ea1312bc58148cfa4654d939c23d3d3d

  • SHA256

    345b8405ff606f8542ed48fc44c6da3a35df6afacf198698ea52e6e9642eac06

  • SHA512

    97184d7296f0c6d623fc1f4978fe71b7a05331f8230261a3ab21f5bf0a98bbd1920aaa68839570c6360d7b95079f66627f38ed381c5ddcfc7f4ba7a9d3cf9027

  • SSDEEP

    192:e1p2Dl10jI4fnw4S9KNPGwRFZKjhdcAhkYe//h9JsAa96cIKjwEYV83edpnHoCYE:U9f5pkwAhkcAa95BYljgmslC97C

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RESTORE_FILES-GHPZRGFC.txt

Ransom Note
--- What happened? --- All of your files are encrypted and stolen. Stolen data will be published soon on our tor website. There is no way to recover your data and prevent data leakage without us Decryption is not possible without private key. Don't waste your and our time to recover your files. It is impossible without our help --- How to recover files & prevent leakage? --- To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty. We promise that you can recover all your files safely and prevent data leakage. We can do it! --- Contact Us--- Download Tox chat from https://tox.chat/download.html Send us friend request to ID B1087CC15FFA75368DD104E9E37B6B9EC113DFFF4D03895CC6FD0640BA98296F6AA40E410BC4 OR Download Tor Browser - https://www.torproject.org/download/ and install it Open website: http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion Decryption ID: 1L4EMq6KwZpiPQ921MtA2gnhzPBVBkp4
URLs

https://tox.chat/download.html

http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion

Extracted

Path

C:\Users\Public\Libraries\RESTORE_FILES-DBXSZVGV.txt

Ransom Note
--- What happened? --- All of your files are encrypted and stolen. Stolen data will be published soon on our tor website. There is no way to recover your data and prevent data leakage without us Decryption is not possible without private key. Don't waste your and our time to recover your files. It is impossible without our help --- How to recover files & prevent leakage? --- To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty. We promise that you can recover all your files safely and prevent data leakage. We can do it! --- Contact Us--- Download Tox chat from https://tox.chat/download.html Send us friend request to ID B1087CC15FFA75368DD104E9E37B6B9EC113DFFF4D03895CC6FD0640BA98296F6AA40E410BC4 OR Download Tor Browser - https://www.torproject.org/download/ and install it Open website: http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion Decryption ID: 1LN0Mgj0K8whNHLgKT7frA7fWF3z7Ap4
URLs

https://tox.chat/download.html

http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion

Targets

    • Target

      2024-03-06_e396682fa41f62fc399419848377f59f_destroyer_wannacry

    • Size

      22KB

    • MD5

      e396682fa41f62fc399419848377f59f

    • SHA1

      69e6c685ea1312bc58148cfa4654d939c23d3d3d

    • SHA256

      345b8405ff606f8542ed48fc44c6da3a35df6afacf198698ea52e6e9642eac06

    • SHA512

      97184d7296f0c6d623fc1f4978fe71b7a05331f8230261a3ab21f5bf0a98bbd1920aaa68839570c6360d7b95079f66627f38ed381c5ddcfc7f4ba7a9d3cf9027

    • SSDEEP

      192:e1p2Dl10jI4fnw4S9KNPGwRFZKjhdcAhkYe//h9JsAa96cIKjwEYV83edpnHoCYE:U9f5pkwAhkcAa95BYljgmslC97C

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Detects command variations typically used by ransomware

    • Modifies boot configuration data using bcdedit

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks