General

  • Target

    2024-06-06_a47cba5449bed1ff259e3cef2ab285ea_destroyer_wannacry

  • Size

    26KB

  • Sample

    240606-bvj6nadf9y

  • MD5

    a47cba5449bed1ff259e3cef2ab285ea

  • SHA1

    454888a1a43032e333c22dc6fdf7bbad1b0b0970

  • SHA256

    e2af60fadb05a57ec747bd56a918a5e5716410817d23df727909e36e95fa0aef

  • SHA512

    e9df43d65e169f8325916ffd783446998c9163f88eeee5c838e6b7e5d8cf39e731c779b42f4769aedbef998ec252e52ea453d383161bbcaf7cd57928472d2a64

  • SSDEEP

    384:4PzYzvnvixdrqvwCMkNCk0Aa9+UYu7vl/ps4+7UQHIf:ug6xdrL9+Un9WNzHIf

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\Readme-ID-KXIPPCKF.txt

Ransom Note
########################################## ######## YOUR FILES ARE ENCRYPTED ###### ########################################## - Your files have been encrypted with strong encryption algorithms and modified. Now have the '.crypted' extension! The file structure was not damaged. Don't worry your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely. We guarantee that you can recover all of your data easily. We are give you full instruction. And help you untill decryption process is fully finished. - We can prove that we can decrypt all of your data. Please just send us 3 not important, small(~2mb) encrypted files, which are randomly stored on your server. Also attach your README-ID.txt left by us in every folder. We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information. - If you will not start a dialogue with us in 72 hours we will be forced to publish your files in the public domain. Your customers and partners will be informed about the data leak. This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases and personal data to interested parties to generate some profit. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. - If you wish to decrypt your files you will need to pay in Bitcoins. If you want to resolve this situation, attach in letter this file README-ID.txt and write to ALL of these 2 email addresses: * [email protected] * [email protected] - IMPORTANT! * We recommend you contact us directly to avoid overpaying agents. You data encrypted and only WE ARE have decryption key. To decrypt your data you need just 1 hour, after payment, no more than. * We asking to send your message to ALL of our 2 email adresses and Telegram, because for various reasons, your email may not be delivered. * Our message may be recognized as spam, so be sure to check the spam folder. * If we do not respond to you within 24 hours, write to us from another email address. * Please don't waste the time, it will result only additinal damage to your company. * Please do not rename and try to decrypt the files yourself. We will not be able to help you if files will be modified. * If you will try to use any third party software for restoring your data or antivirus solutions, please make a backup for all encrypted files. * If you delete any encrypted files from the current computer, you may not be able to decrypt them.

Targets

    • Target

      2024-06-06_a47cba5449bed1ff259e3cef2ab285ea_destroyer_wannacry

    • Size

      26KB

    • MD5

      a47cba5449bed1ff259e3cef2ab285ea

    • SHA1

      454888a1a43032e333c22dc6fdf7bbad1b0b0970

    • SHA256

      e2af60fadb05a57ec747bd56a918a5e5716410817d23df727909e36e95fa0aef

    • SHA512

      e9df43d65e169f8325916ffd783446998c9163f88eeee5c838e6b7e5d8cf39e731c779b42f4769aedbef998ec252e52ea453d383161bbcaf7cd57928472d2a64

    • SSDEEP

      384:4PzYzvnvixdrqvwCMkNCk0Aa9+UYu7vl/ps4+7UQHIf:ug6xdrL9+Un9WNzHIf

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Detects command variations typically used by ransomware

    • Modifies boot configuration data using bcdedit

    • Renames multiple (222) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks