Overview

overview

10

Static

static

3

!All malware.zip

windows10-1703-x64

10

Resubmissions

19-04-2024 11:45

240419-nw88dsag38 10

19-04-2024 11:43

240419-nv23pabf2x 3

19-04-2024 10:25

240419-mf6a5agh7t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    !All malware.zip

  • Size

    6.4MB

  • Sample

    240419-nw88dsag38

  • MD5

    cdf646d5bfa6e006d61d9b2720e96341

  • SHA1

    48a6f50b17b242f3abfeff00968960eeaa6e5ff9

  • SHA256

    4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1

  • SHA512

    bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30

  • SSDEEP

    196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target

      !All malware.zip

    • Size

      6.4MB

    • MD5

      cdf646d5bfa6e006d61d9b2720e96341

    • SHA1

      48a6f50b17b242f3abfeff00968960eeaa6e5ff9

    • SHA256

      4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1

    • SHA512

      bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30

    • SSDEEP

      196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies file permissions

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks