Overview

overview

10

Static

static

3

000.exe

windows7-x64

000.exe

windows10-1703-x64

000.exe

windows10-2004-x64

1

000.exe

windows11-21h2-x64

Ana.exe

windows7-x64

8

Ana.exe

windows10-1703-x64

7

Ana.exe

windows10-2004-x64

Ana.exe

windows11-21h2-x64

Bad Rabit.exe

windows7-x64

10

Bad Rabit.exe

windows10-1703-x64

10

Bad Rabit.exe

windows10-2004-x64

10

Bad Rabit.exe

windows11-21h2-x64

10

Desktop Puzzle.exe

windows7-x64

1

Desktop Puzzle.exe

windows10-1703-x64

1

Desktop Puzzle.exe

windows10-2004-x64

1

Desktop Puzzle.exe

windows11-21h2-x64

1

Memz.exe

windows7-x64

6

Memz.exe

windows10-1703-x64

7

Memz.exe

windows10-2004-x64

Memz.exe

windows11-21h2-x64

6

NoEscape.exe

windows7-x64

1

NoEscape.exe

windows10-1703-x64

NoEscape.exe

windows10-2004-x64

NoEscape.exe

windows11-21h2-x64

WannaCrypt0r.exe

windows7-x64

10

WannaCrypt0r.exe

windows10-1703-x64

10

WannaCrypt0r.exe

windows10-2004-x64

10

WannaCrypt0r.exe

windows11-21h2-x64

10

Resubmissions

01-05-2024 18:02

240501-wmf49acg3s 6

27-04-2024 08:46

240427-kpfeysff8s 10

25-04-2024 21:25

240425-z9y55afb7v 10

25-04-2024 21:16

240425-z4pphafa97 10

25-04-2024 18:27

240425-w3929sde33 10

25-04-2024 18:17

240425-ww4a5sdc8x 10

25-04-2024 18:15

240425-wwbwwsdc71 10

25-04-2024 18:15

240425-wv1tmadc7w 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Malware.zip

  • Size

    6.4MB

  • Sample

    240419-mb7ndsfe92

  • MD5

    2570272f3d1d089334463f58135099be

  • SHA1

    c3c47f1a8420d11be52cf69f2cafcec450b36b36

  • SHA256

    2a45e44be359fba4c85591e7b13d1ec772ed181adc41254d8b00d31b2d15878e

  • SHA512

    4921f1e3fa8dc8b019587aad62a67b449175fe6cfb8e7b01474a3eb5683c1c475f34247e4a6b248bea3e432ed413721519a52b2d1ef0f3f088876cd98cec31f9

  • SSDEEP

    196608:Pjlmaezq3Z39giBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiB:PYaIwgiKt2O9/rH6T6yigHRHGxB

Score
10/10
badrabbitmimikatzwannacrybootkitdiscoveryevasionpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      000.exe

    • Size

      6.7MB

    • MD5

      f2b7074e1543720a9a98fda660e02688

    • SHA1

      1029492c1a12789d8af78d54adcb921e24b9e5ca

    • SHA256

      4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

    • SHA512

      73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

    • SSDEEP

      3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9

    Score
    8/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2behavioral3behavioral4

    • Target

      Ana.exe

    • Size

      2.1MB

    • MD5

      f571faca510bffe809c76c1828d44523

    • SHA1

      7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

    • SHA256

      117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

    • SHA512

      a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

    • SSDEEP

      49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoy:OxPUDQmso0NuBZlnCItM

    Score
    8/10
    bootkitdiscoveryevasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral5behavioral6behavioral7behavioral8

    • Target

      Bad Rabit.exe

    • Size

      431KB

    • MD5

      fbbdc39af1139aebba4da004475e8839

    • SHA1

      de5c8d858e6e41da715dca1c019df0bfb92d32c0

    • SHA256

      630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

    • SHA512

      74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

    • SSDEEP

      12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

    Score
    10/10
    badrabbitmimikatzransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral11behavioral12behavioral9

    • Target

      Desktop Puzzle.exe

    • Size

      239KB

    • MD5

      2f8f6e90ca211d7ef5f6cf3c995a40e7

    • SHA1

      f8940f280c81273b11a20d4bfb43715155f6e122

    • SHA256

      1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6

    • SHA512

      2b38475550edee5519e33bd18fea510ad73345a27c20f6457710498d34e3d0cf05b0f96f32d018e7dc154a6f2232ea7e3145fd0ed5fb498f9e4702a4be1bb9c8

    • SSDEEP

      3072:r/3qftCdbSFtY8Zf8pOk0rHitNWIekbnfFPsr24Cv/Eng9m3ihlCeKH6Fb6aX3WA:WoI/rC0k7ar68nimCYHe3qZr0SlC

    Score
    1/10
    behavioral13behavioral14behavioral15behavioral16

    • Target

      Memz.exe

    • Size

      14KB

    • MD5

      19dbec50735b5f2a72d4199c4e184960

    • SHA1

      6fed7732f7cb6f59743795b2ab154a3676f4c822

    • SHA256

      a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

    • SHA512

      aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

    • SSDEEP

      192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

    Score
    7/10
    bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral17behavioral18behavioral19behavioral20

    • Target

      NoEscape.exe

    • Size

      666KB

    • MD5

      989ae3d195203b323aa2b3adf04e9833

    • SHA1

      31a45521bc672abcf64e50284ca5d4e6b3687dc8

    • SHA256

      d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f

    • SHA512

      e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305

    • SSDEEP

      12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t

    Score
    10/10
    evasionpersistenceransomwaretrojan
    behavioral21behavioral22behavioral23behavioral24

    • Target

      WannaCrypt0r.exe

    • Size

      3.4MB

    • MD5

      84c82835a5d21bbcf75a61706d8ab549

    • SHA1

      5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

    • SHA256

      ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

    • SHA512

      90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

    • SSDEEP

      98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

    Score
    10/10
    wannacrydiscoveryransomwarespywarestealerwormpersistence

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral25behavioral26behavioral27behavioral28

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

3
T1547.004

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

3
T1547.004

Scheduled Task/Job

1
T1053

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

13
T1112

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

7
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

13
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

3
T1491

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

evasionpersistenceransomware
Score
8/10

behavioral2

evasionpersistenceransomware
Score
8/10

behavioral3

Score
1/10

behavioral4

evasionpersistenceransomware
Score
8/10

behavioral5

bootkitdiscoveryevasionpersistencetrojanupx
Score
8/10

behavioral6

bootkitdiscoveryevasionpersistencetrojanupx
Score
7/10

behavioral7

bootkitdiscoveryevasionpersistencetrojanupx
Score
7/10

behavioral8

upx
Score
7/10

behavioral9

badrabbitmimikatzransomware
Score
10/10

behavioral10

badrabbitmimikatzransomware
Score
10/10

behavioral11

badrabbitmimikatzransomware
Score
10/10

behavioral12

badrabbitmimikatzransomware
Score
10/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

bootkitpersistence
Score
6/10

behavioral18

bootkitpersistence
Score
7/10

behavioral19

bootkitpersistence
Score
7/10

behavioral20

bootkitpersistence
Score
6/10

behavioral21

Score
1/10

behavioral22

evasionpersistenceransomwaretrojan
Score
10/10

behavioral23

evasionpersistenceransomwaretrojan
Score
10/10

behavioral24

evasionpersistenceransomwaretrojan
Score
10/10

behavioral25

wannacrydiscoveryransomwarespywarestealerworm
Score
10/10

behavioral26

wannacrydiscoveryransomwarespywarestealerworm
Score
10/10

behavioral27

wannacrydiscoveryransomwarespywarestealerworm
Score
10/10

behavioral28

wannacrydiscoverypersistenceransomwarespywarestealerworm
Score
10/10