Overview

overview

10

Static

static

3

000.exe

windows10-1703-x64

000.exe

windows10-2004-x64

Ana.exe

windows10-1703-x64

7

Ana.exe

windows10-2004-x64

Bad Rabit.exe

windows10-1703-x64

10

Bad Rabit.exe

windows10-2004-x64

10

D34TH 2.0 .bat

windows10-1703-x64

8

D34TH 2.0 .bat

windows10-2004-x64

8

DDOS.bat

windows10-1703-x64

3

DDOS.bat

windows10-2004-x64

7

Desktop Puzzle.exe

windows10-1703-x64

1

Desktop Puzzle.exe

windows10-2004-x64

1

Memz.exe

windows10-1703-x64

7

Memz.exe

windows10-2004-x64

7

NoEscape.exe

windows10-1703-x64

NoEscape.exe

windows10-2004-x64

Phantom Crypter.bat

windows10-1703-x64

8

Phantom Crypter.bat

windows10-2004-x64

8

WannaCrypt0r.exe

windows10-1703-x64

10

WannaCrypt0r.exe

windows10-2004-x64

10

infinite locker.bat

windows10-1703-x64

7

infinite locker.bat

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    !All malware.zip

  • Size

    6.4MB

  • Sample

    240419-merrcafh69

  • MD5

    cdf646d5bfa6e006d61d9b2720e96341

  • SHA1

    48a6f50b17b242f3abfeff00968960eeaa6e5ff9

  • SHA256

    4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1

  • SHA512

    bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30

  • SSDEEP

    196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG

Score
10/10
badrabbitmimikatzwannacrybootkitdiscoveryevasionpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target

      000.exe

    • Size

      6.7MB

    • MD5

      f2b7074e1543720a9a98fda660e02688

    • SHA1

      1029492c1a12789d8af78d54adcb921e24b9e5ca

    • SHA256

      4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

    • SHA512

      73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

    • SSDEEP

      3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9

    Score
    8/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

    • Target

      Ana.exe

    • Size

      2.1MB

    • MD5

      f571faca510bffe809c76c1828d44523

    • SHA1

      7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

    • SHA256

      117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

    • SHA512

      a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

    • SSDEEP

      49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoy:OxPUDQmso0NuBZlnCItM

    Score
    7/10
    bootkitdiscoveryevasionpersistencetrojanupx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      Bad Rabit.exe

    • Size

      431KB

    • MD5

      fbbdc39af1139aebba4da004475e8839

    • SHA1

      de5c8d858e6e41da715dca1c019df0bfb92d32c0

    • SHA256

      630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

    • SHA512

      74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

    • SSDEEP

      12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

    Score
    10/10
    badrabbitmimikatzransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6

    • Target

      D34TH 2.0 .bat

    • Size

      1KB

    • MD5

      8ee9033a02ee6fc3b932b694c1bc631c

    • SHA1

      6d64ea5dadd6d5098342213a1cf354896b8a3963

    • SHA256

      1609a6c649ea074815ce85da21935137e9c79c79a41088a6f7e99a56bd20340d

    • SHA512

      f1735b2a7f4b384cf3a82f17e2834912f04d554350d6a03dd1ff6b55efb161e900ae14bd1c337f40d4692d390a726219c85d3a8df6164bac73e2f5c3d38d6a91

    Score
    8/10
    discoveryevasion

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    • Modifies termsrv.dll

      Commonly used to allow simultaneous RDP sessions.

    behavioral7behavioral8

    • Target

      DDOS.bat

    • Size

      151B

    • MD5

      912557eed9e6f6098b3033aaf310b697

    • SHA1

      9c05231febc2325be23d267d2bba302ac7489872

    • SHA256

      cf9f511f61b544299c5812abc0e524b9bd887acb2294fbec085515609b3ed44d

    • SHA512

      f196e8055901b56e3a6bae734bff40d28edd4fbbe21f51135c7a0cbab7d3d5bf41f59528bf434e557b49d943c881c13fc6ada2f2d263d4f660de3585117e58fe

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9

    • Target

      Desktop Puzzle.exe

    • Size

      239KB

    • MD5

      2f8f6e90ca211d7ef5f6cf3c995a40e7

    • SHA1

      f8940f280c81273b11a20d4bfb43715155f6e122

    • SHA256

      1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6

    • SHA512

      2b38475550edee5519e33bd18fea510ad73345a27c20f6457710498d34e3d0cf05b0f96f32d018e7dc154a6f2232ea7e3145fd0ed5fb498f9e4702a4be1bb9c8

    • SSDEEP

      3072:r/3qftCdbSFtY8Zf8pOk0rHitNWIekbnfFPsr24Cv/Eng9m3ihlCeKH6Fb6aX3WA:WoI/rC0k7ar68nimCYHe3qZr0SlC

    Score
    1/10
    behavioral11behavioral12

    • Target

      Memz.exe

    • Size

      14KB

    • MD5

      19dbec50735b5f2a72d4199c4e184960

    • SHA1

      6fed7732f7cb6f59743795b2ab154a3676f4c822

    • SHA256

      a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

    • SHA512

      aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

    • SSDEEP

      192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

    Score
    7/10
    bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral13behavioral14

    • Target

      NoEscape.exe

    • Size

      666KB

    • MD5

      989ae3d195203b323aa2b3adf04e9833

    • SHA1

      31a45521bc672abcf64e50284ca5d4e6b3687dc8

    • SHA256

      d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f

    • SHA512

      e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305

    • SSDEEP

      12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t

    Score
    10/10
    evasionpersistenceransomwaretrojan
    behavioral15behavioral16

    • Target

      Phantom Crypter.bat

    • Size

      5KB

    • MD5

      86048f27a743bfd1c7e50fc611e50047

    • SHA1

      3ff7974076f5b600fd7bddf0b0b1cf98247d46c3

    • SHA256

      2d07538b05f785bec00733dd27374d46411042344c08a847f9f0ce297479cb6e

    • SHA512

      84e5b6ce2ecb65fc4f294f1a940ce76ab8f929e619ff5659040a082a4d55bf0be047884c8111d4aa0482131919611590e4c9ab4aa2e88ccb6ffe508a85f48bfe

    • SSDEEP

      96:1E2FFXpOnWvbClLy2Ju7y5KQZ2Ju7y5KJ:1E2VbClLyX7ycCX7ycJ

    Score
    8/10
    discoveryevasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Modifies file permissions

      discovery

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral17behavioral18

    • Target

      WannaCrypt0r.exe

    • Size

      3.4MB

    • MD5

      84c82835a5d21bbcf75a61706d8ab549

    • SHA1

      5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

    • SHA256

      ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

    • SHA512

      90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

    • SSDEEP

      98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

    Score
    10/10
    wannacrydiscoverypersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral19behavioral20

    • Target

      infinite locker.bat

    • Size

      1KB

    • MD5

      ee64ffe8afb7ae50a94654b29b18e805

    • SHA1

      845b1d1841eaebc4cf87f796ff272595b82b0a99

    • SHA256

      0c2401442ccedb4cecb194044cd5c8893ae44ad84f549c4d9007a78153e26f40

    • SHA512

      22bad3b85221af74cb931a6e358c6eb11ede54536c0bdf6a1f848589981a4608e4c2e41bf348fbbc3390026f206a6fcf899ea2877d19a402169e801bd3ec103b

    Score
    7/10
    discovery
    behavioral21behavioral22

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Command and Scripting Interpreter

2
T1059

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

3
T1547.004

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Scheduled Task/Job

1
T1053

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

3
T1547.004

Scheduled Task/Job

1
T1053

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

12
T1112

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Impair Defenses

3
T1562

Disable or Modify Tools

1
T1562.001

Disable or Modify System Firewall

2
T1562.004

File and Directory Permissions Modification

4
T1222

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

9
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

20
T1082

Lateral Movement

Remote Services

1
T1021

Remote Desktop Protocol

1
T1021.001

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

3
T1491

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

evasionpersistenceransomware
Score
8/10

behavioral2

evasionpersistenceransomware
Score
8/10

behavioral3

bootkitdiscoveryevasionpersistencetrojanupx
Score
7/10

behavioral4

bootkitdiscoveryevasionpersistencetrojanupx
Score
7/10

behavioral5

badrabbitmimikatzransomware
Score
10/10

behavioral6

badrabbitmimikatzransomware
Score
10/10

behavioral7

discoveryevasion
Score
8/10

behavioral8

discoveryevasion
Score
8/10

behavioral9

Score
3/10

behavioral10

Score
7/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

bootkitpersistence
Score
7/10

behavioral14

bootkitpersistence
Score
7/10

behavioral15

evasionpersistenceransomwaretrojan
Score
10/10

behavioral16

evasionpersistenceransomwaretrojan
Score
10/10

behavioral17

discoveryevasion
Score
8/10

behavioral18

discoveryevasion
Score
8/10

behavioral19

wannacrydiscoverypersistenceransomwarespywarestealerworm
Score
10/10

behavioral20

wannacrydiscoverypersistenceransomwarespywarestealerworm
Score
10/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10