Overview

overview

10

Static

static

3

FMLN Ransomware.exe

windows7-x64

6

FMLN Ransomware.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FMLN Ransomware.exe

  • Size

    258KB

  • Sample

    240425-zz17qsfa24

  • MD5

    c87988e35ec34779191f42b6213fdec1

  • SHA1

    81036dcf6ea331243f2d512b8ac9611a95a18ea1

  • SHA256

    96f3ce153153f922fb18e4722b0348aee2c76022bcdee75fadab97023003fe10

  • SHA512

    ba32f9bc18fb187fa4dc03bb1db903255c16af62dc903521ddd8fb120e5599bbccb4fa12255f0195a5e51b6a99ee5228bc0515f299c0ebb1b1a5134e61aab9e4

  • SSDEEP

    6144:sBlkZvaF4NTBjWXXn0tHeKMSF0o91TPoEQo:soSWNTRsOBMSF31TgW

Score
10/10
wannacrydiscoverypersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      FMLN Ransomware.exe

    • Size

      258KB

    • MD5

      c87988e35ec34779191f42b6213fdec1

    • SHA1

      81036dcf6ea331243f2d512b8ac9611a95a18ea1

    • SHA256

      96f3ce153153f922fb18e4722b0348aee2c76022bcdee75fadab97023003fe10

    • SHA512

      ba32f9bc18fb187fa4dc03bb1db903255c16af62dc903521ddd8fb120e5599bbccb4fa12255f0195a5e51b6a99ee5228bc0515f299c0ebb1b1a5134e61aab9e4

    • SSDEEP

      6144:sBlkZvaF4NTBjWXXn0tHeKMSF0o91TPoEQo:soSWNTRsOBMSF31TgW

    Score
    10/10
    ransomwarewannacrydiscoverypersistenceworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

File and Directory Permissions Modification

1
T1222

Modify Registry

3
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks