Overview

overview

10

Static

static

3

recroom doxes.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    recroom doxes.exe

  • Size

    10KB

  • Sample

    240511-g3n3gacg36

  • MD5

    b2d64d7351a733c044c35df29e128b8f

  • SHA1

    dbea99efefe266261bff99208c07336a2ff1e92a

  • SHA256

    2f435d8698369f6d6cf9cb68fda56fd61cf266c0df911f4a634d701dd0a40ca6

  • SHA512

    5f09b1ff9028983a88fbefdb462ac4811303e277016efb7fa21b7ae3b9fd083011dc2a7cf06ee9233d7e009ce4b2ed4448ebedff701dbebbbf6662473c8f5231

  • SSDEEP

    96:NKMPnZ4eNF/pedzDv99S+6xxX5ZQMdeMvqnr4lmjOCq+f/fXa6LG2sVzcPlDLzNt:s4hfpedzb9EPxXnrunHHsVz2DN

Score
10/10
wannacrydiscoverypersistenceransomwarespywarestealerupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Computer-Virus-master\Computer-Virus-master\WannaCry\EternalBlue\sources\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target

      recroom doxes.exe

    • Size

      10KB

    • MD5

      b2d64d7351a733c044c35df29e128b8f

    • SHA1

      dbea99efefe266261bff99208c07336a2ff1e92a

    • SHA256

      2f435d8698369f6d6cf9cb68fda56fd61cf266c0df911f4a634d701dd0a40ca6

    • SHA512

      5f09b1ff9028983a88fbefdb462ac4811303e277016efb7fa21b7ae3b9fd083011dc2a7cf06ee9233d7e009ce4b2ed4448ebedff701dbebbbf6662473c8f5231

    • SSDEEP

      96:NKMPnZ4eNF/pedzDv99S+6xxX5ZQMdeMvqnr4lmjOCq+f/fXa6LG2sVzcPlDLzNt:s4hfpedzb9EPxXnrunHHsVz2DN

    Score
    10/10
    wannacrydiscoverypersistenceransomwarespywarestealerupxworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks