Resubmissions

18-05-2024 08:15

240518-j53dzsbc5x 10

18-05-2024 08:05

240518-jywb4aah7t 8

18-05-2024 06:57

240518-hrev4agg4z 7

General

  • Target

    a77c54306bb0f7526d059b0a76cc4bb0_NeikiAnalytics.exe

  • Size

    320KB

  • Sample

    240518-j53dzsbc5x

  • MD5

    a77c54306bb0f7526d059b0a76cc4bb0

  • SHA1

    75c29b4c97783d5f69925296582358d36011cf90

  • SHA256

    d8e0e4e4c6d3ee6e27ea515fe0bab1d9e9627d9fd603128cdacdd28fbcfd7b5f

  • SHA512

    1db46c0b73aba5ce553213ccaad2a256dc729e861326460e83739a4a7368ac547c88da953beef3151df89b423dc259e05cf429ce209fbab463ec2b3c4057c53a

  • SSDEEP

    6144:7tatPE5TxP8ev1zQBgexOdw6rpI9FsAC9:oPwTt8Cl+zGp64

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      a77c54306bb0f7526d059b0a76cc4bb0_NeikiAnalytics.exe

    • Size

      320KB

    • MD5

      a77c54306bb0f7526d059b0a76cc4bb0

    • SHA1

      75c29b4c97783d5f69925296582358d36011cf90

    • SHA256

      d8e0e4e4c6d3ee6e27ea515fe0bab1d9e9627d9fd603128cdacdd28fbcfd7b5f

    • SHA512

      1db46c0b73aba5ce553213ccaad2a256dc729e861326460e83739a4a7368ac547c88da953beef3151df89b423dc259e05cf429ce209fbab463ec2b3c4057c53a

    • SSDEEP

      6144:7tatPE5TxP8ev1zQBgexOdw6rpI9FsAC9:oPwTt8Cl+zGp64

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks