General

  • Target

    MaxsStupidZipFileScanner.exe

  • Size

    200KB

  • Sample

    240420-t8mstach27

  • MD5

    e48a10bfe0b5fc70fb5fb201e2a15a8e

  • SHA1

    4d1acd4e53fcd1ca471931297939057418426a8a

  • SHA256

    e67846454c5c7e86cb077a5c349b8ce526515101bf1c66b7af44d5c099b0bb72

  • SHA512

    5352843bc600823a5825d6f3c36ed5f2660e0291ff8059b5baa86f69ecdd0b40a05e3c9a0a2e265c8ad57dbdf138f4facaf2f30412265b4c786de7022589110e

  • SSDEEP

    6144:dQnaLViJ8gQZsEezHMg/afKh+tHA6TcWOchSI5Ezwtgz:dQn6i2yEezsg/aSMtHA6wWO8SeEzwtgz

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target

      MaxsStupidZipFileScanner.exe

    • Size

      200KB

    • MD5

      e48a10bfe0b5fc70fb5fb201e2a15a8e

    • SHA1

      4d1acd4e53fcd1ca471931297939057418426a8a

    • SHA256

      e67846454c5c7e86cb077a5c349b8ce526515101bf1c66b7af44d5c099b0bb72

    • SHA512

      5352843bc600823a5825d6f3c36ed5f2660e0291ff8059b5baa86f69ecdd0b40a05e3c9a0a2e265c8ad57dbdf138f4facaf2f30412265b4c786de7022589110e

    • SSDEEP

      6144:dQnaLViJ8gQZsEezHMg/afKh+tHA6TcWOchSI5Ezwtgz:dQn6i2yEezsg/aSMtHA6wWO8SeEzwtgz

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies file permissions

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks