Overview

overview

10

Static

static

10

2024-04-30...ry.exe

windows10-2004-x64

Resubmissions

30-04-2024 19:18

240430-x1bx5aga38 10

30-04-2024 18:59

240430-xm42rafe58 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry

  • Size

    1.1MB

  • Sample

    240430-x1bx5aga38

  • MD5

    c9f6fc22d04c4d56622e9322d1a34d70

  • SHA1

    d45ed6385e183456f1d0f68aba47727df1d38256

  • SHA256

    b7b3f9f8e59c42d40505a0e53039b69ba969b84b14d31a71557f5a09855b678a

  • SHA512

    f73342e15b3f1fb180f845950ed90f0fdc9c54f1040d457d78f2a13be445d65650dca455b254254db566e81b4c089539370edda3ef76a4c5bbc32ea7aaaa40e2

  • SSDEEP

    12288:o7YHBR9ideJWmXm+if5BYstvfCjqf2KqY5UBx2qIYvnv+pkiccfIzdLzsb4D7ZfL:ogBNq5u0v6AUjBfLyZEi

Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note
(Explanation) Shit well unfornatley you have fallen for my ransomware. Meaning that all of your personal files like your images, videos, applications etc are locked. In order to get your files back you will need to pay a small fee of 0.0008 bitcoin. You may be asking yourself well how the fuck do I get bitcoin and or what is bitcoin. Well bitcoin is a digital currency that can be converted into USD anonymously. Buying bitcoin is super easy you can buy it at bitcoin atms near you or applications on your phone which I will If you do not care about your files they will automatically be deleted in 2 days or you can reset your computer. If you do care about your files then please follow the instructions to successfully recover your files. Step 1: Create a bitcoin wallet on your phone or whatever mobile device you are using. DO NOT create a bitcoin wallet on your computer or you could possibly lose all of your funds (I'm saving you the trouble of losing out on even more of your money). I would recommend downloading the wallet 'Cake Wallet'. It is very simple to use for begginners and works great it is available on the apple app store and google play store aswell. Step 2: You Will need to buy bitcoin to pay the ransom in recovering your files. Some places to buy bitcoin could be for example https://coinflip.tech (This is a website that tells you where the nearest bitcoin atm is from you the fee is 15.99% so you may need to bring more cash with you.) You can fill your wallet up until you have enough to send the ransom and cover the fee you need to pay me the fees on sending bitcoin usually sits between $4-$6. If you have cashapp you can try sending bitcoin that way aswell there is a place where you can invest into bitcoin I would recommend watching videos on buying and sending it. Step 3: Once you have boughten bitcoin you will need to send it. Please scan the QR code that is shown in my wallpaper. The wallpaper is on your computer if you have not already seen it. If you are unsure on how to scan it with a bitcoin wallet you made on your mobile device then please scan the qr code by going into your camera app and hovering over it. It should pop up with a bitcoin address once you get the bitcoin address then send the required bitcoin. You can also use snapchat's camera to scan bitcoin QR codes. If you are using cake wallet select that 'fast' option for a fast confirmation the faster I can confirm that the bitcoin has been sent to my bitcoin address the faster you will get your files back. If you are using cash app to send the bitcoin select the fastest option for a quick payment. Step 4: Contact my email once the bitcoin is sent again the bitcoin needs to be sent from a different device other then the infected computer in order to make a smoothe and quick transaction. My Email: whosdumb_stackz@proton.me Step 5: A decrypter will be provided to you once the payment is sent make sure that you disable virus protection temporaily again to decrypt your files. To decrypt please drag the private key into the decrypter application it should say 'Open With' and just hit 'more info' and select yes if needed to run it. After it is ran your files will then successfully be unlocked and in your possession. If a payment has not been made within 2 days all of your personal files on your computer such as your pictures, passwords, any data, private logs, etc will be sent out on to the darkweb or (The Tor Browser). As well as any connected USB's or backup drives will also have been infected and they will be sent out on the dark web as well. It is important to have good communication with me or if my one of my workers (who spread the malware on your computer) is helping you out for example make such that they can verify that the payment has gone through. No further warnings will go out. Once again please make a crypto wallet on a different device other then your computer because there is a high chance that you will lose your funds using your computer. So Again I recommend using a Phone or any other mobile device that you have. If you forgot how much to send in bitcoin to the qr code it was 0.0008 Bitcoin Again my email to contact me at is: whosdumb_stackz@proton.me
Emails

whosdumb_stackz@proton.me

URLs

https://coinflip.tech

Targets

    • Target

      2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry

    • Size

      1.1MB

    • MD5

      c9f6fc22d04c4d56622e9322d1a34d70

    • SHA1

      d45ed6385e183456f1d0f68aba47727df1d38256

    • SHA256

      b7b3f9f8e59c42d40505a0e53039b69ba969b84b14d31a71557f5a09855b678a

    • SHA512

      f73342e15b3f1fb180f845950ed90f0fdc9c54f1040d457d78f2a13be445d65650dca455b254254db566e81b4c089539370edda3ef76a4c5bbc32ea7aaaa40e2

    • SSDEEP

      12288:o7YHBR9ideJWmXm+if5BYstvfCjqf2KqY5UBx2qIYvnv+pkiccfIzdLzsb4D7ZfL:ogBNq5u0v6AUjBfLyZEi

    Score
    10/10
    chaosevasionpersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (223) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

7
T1112

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

7
T1012

System Information Discovery

7
T1082

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks