General
- Target http://pluh.com
- Sample240625-vmmflascmc
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\@[email protected]
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets
-
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
Path
-
C:\Users\Admin\Downloads\msg\m_english.wnry
Ransom Note
- {\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;} {\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;} {\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;} {\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;} {\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhiminor\f31506\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\fbiminor\f31507\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f540\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\f541\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\f543\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\f544\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\f545\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\f546\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\f547\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\f548\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\f550\fbidi \fswiss\fcharset238\fprq2 Arial CE;} {\f551\fbidi \fswiss\fcharset204\fprq2 Arial Cyr;}{\f553\fbidi \fswiss\fcharset161\fprq2 Arial Greek;}{\f554\fbidi \fswiss\fcharset162\fprq2 Arial Tur;}{\f555\fbidi \fswiss\fcharset177\fprq2 Arial (Hebrew);} {\f556\fbidi \fswiss\fcharset178\fprq2 Arial (Arabic);}{\f557\fbidi \fswiss\fcharset186\fprq2 Arial Baltic;}{\f558\fbidi \fswiss\fcharset163\fprq2 Arial (Vietnamese);}{\f880\fbidi \froman\fcharset238\fprq2 Cambria Math CE;} {\f881\fbidi \froman\fcharset204\fprq2 Cambria Math Cyr;}{\f883\fbidi \froman\fcharset161\fprq2 Cambria Math Greek;}{\f884\fbidi \froman\fcharset162\fprq2 Cambria Math Tur;}{\f887\fbidi \froman\fcharset186\fprq2 Cambria Math Baltic;} {\f888\fbidi \froman\fcharset163\fprq2 Cambria Math (Vietnamese);}{\f910\fbidi \froman\fcharset238\fprq2 Cambria CE;}{\f911\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\f913\fbidi \froman\fcharset161\fprq2 Cambria Greek;} {\f914\fbidi \froman\fcharset162\fprq2 Cambria Tur;}{\f917\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\f918\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\f950\fbidi \fmodern\fcharset238\fprq1 Consolas CE;} {\f951\fbidi \fmodern\fcharset204\fprq1 Consolas Cyr;}{\f953\fbidi \fmodern\fcharset161\fprq1 Consolas Greek;}{\f954\fbidi \fmodern\fcharset162\fprq1 Consolas Tur;}{\f957\fbidi \fmodern\fcharset186\fprq1 Consolas Baltic;} {\f958\fbidi \fmodern\fcharset163\fprq1 Consolas (Vietnamese);}{\f1072\fbidi \fmodern\fcharset0\fprq1 GulimChe Western;}{\f1070\fbidi \fmodern\fcharset238\fprq1 GulimChe CE;}{\f1071\fbidi \fmodern\fcharset204\fprq1 GulimChe Cyr;} {\f1073\fbidi \fmodern\fcharset161\fprq1 GulimChe Greek;}{\f1074\fbidi \fmodern\fcharset162\fprq1 GulimChe Tur;}{\f1077\fbidi \fmodern\fcharset186\fprq1 GulimChe Baltic;}{\f1082\fbidi \fmodern\fcharset0\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Western;} {\f1080\fbidi \fmodern\fcharset238\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc CE;}{\f1081\fbidi \fmodern\fcharset204\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Cyr;}{\f1083\fbidi \fmodern\fcharset161\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Greek;} {\f1084\fbidi \fmodern\fcharset162\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Tur;}{\f1087\fbidi \fmodern\fcharset186\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Baltic;}{\flomajor\f31508\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\flomajor\f31509\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\flomajor\f31511\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flomajor\f31512\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\flomajor\f31513\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\flomajor\f31514\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flomajor\f31515\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\flomajor\f31516\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\fdbmajor\f31520\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhimajor\f31528\fbidi \froman\fcharset238\fprq2 Cambria CE;} {\fhimajor\f31529\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\fhimajor\f31531\fbidi \froman\fcharset161\fprq2 Cambria Greek;}{\fhimajor\f31532\fbidi \froman\fcharset162\fprq2 Cambria Tur;} {\fhimajor\f31535\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\fhimajor\f31536\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\fbimajor\f31538\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\fbimajor\f31539\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\fbimajor\f31541\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbimajor\f31542\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\fbimajor\f31543\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\fbimajor\f31544\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbimajor\f31545\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\fbimajor\f31546\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\flominor\f31548\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\flominor\f31549\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\flominor\f31551\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flominor\f31552\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\flominor\f31553\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\flominor\f31554\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flominor\f31555\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\flominor\f31556\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);} {\fdbminor\f31560\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhiminor\f31568\fbidi \fswiss\fcharset238\fprq2 Calibri CE;}{\fhiminor\f31569\fbidi \fswiss\fcharset204\fprq2 Calibri Cyr;} {\fhiminor\f31571\fbidi \fswiss\fcharset161\fprq2 Calibri Greek;}{\fhiminor\f31572\fbidi \fswiss\fcharset162\fprq2 Calibri Tur;}{\fhiminor\f31575\fbidi \fswiss\fcharset186\fprq2 Calibri Baltic;} {\fhiminor\f31576\fbidi \fswiss\fcharset163\fprq2 Calibri (Vietnamese);}{\fbiminor\f31578\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\fbiminor\f31579\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\fbiminor\f31581\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbiminor\f31582\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\fbiminor\f31583\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\fbiminor\f31584\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbiminor\f31585\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\fbiminor\f31586\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}} {\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0; \red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\*\defchp \fs22\loch\af31506\hich\af31506\dbch\af31505 }{\*\defpap \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 }\noqfpromote {\stylesheet{\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af31507\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext0 \sqformat \spriority0 \styrsid1847526 Normal;}{\*\cs10 \additive \ssemihidden \sunhideused \spriority1 Default Paragraph Font;}{\* \ts11\tsrowd\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\trcbpat1\trcfpat1\tblind0\tblindtype3\tscellwidthfts0\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext11 \ssemihidden \sunhideused \sqformat Normal Table;}{\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\f41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 \sbasedon0 \snext15 \slink16 \sunhideused \styrsid5268979 Plain Text;}{\*\cs16 \additive \rtlch\fcs1 \af41\afs21 \ltrch\fcs0 \f41\fs21 \sbasedon10 \slink15 \slocked \styrsid5268979 Plain Text Char;}}{\*\rsidtbl \rsid1847526\rsid2183709\rsid5268979\rsid5733561\rsid11488848\rsid14178431\rsid14237745\rsid14313477\rsid14432744}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1 \mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Messi}{\operator Messi}{\creatim\yr2017\mo5\dy11\hr13\min53}{\revtim\yr2017\mo5\dy11\hr14\min42}{\version4}{\edmins4}{\nofpages1}{\nofwords296}{\nofchars1385}{\nofcharsws1678} {\vern32775}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect \widowctrl\ftnbj\aenddoc\trackmoves1\trackformatting1\donotembedsysfont1\relyonvml0\donotembedlingdata0\grfdocevents0\validatexml1\showplaceholdtext0\ignoremixedcontent0\saveinvalidxml0\showxmlerrors1\noxlattoyen \expshrtn\noultrlspc\dntblnsbdb\nospaceforul\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin1501\dgvorigin1701\dghshow1\dgvshow1 \jexpand\viewkind1\viewscale140\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct \asianbrkrule\rsidroot1847526\newtblstyruls\nogrowautofit\usenormstyforlist\noindnmbrts\felnbrelev\nocxsptable\indrlsweleven\noafcnsttbl\afelev\utinl\hwelev\spltpgpar\notcvasp\notbrkcnstfrctbl\notvatxbx\krnprsnet\cachedcolbal \nouicompat \fet0 {\*\wgrffmtfilter 2450}\nofeaturethrottle1\ilfomacatclnup0\ltrpar \sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sectrsid5268979\sftnbj {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl2 \pnucltr\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang {\pntxta \hich )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}\pard\plain \ltrpar\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid5268979 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\af41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 {\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 What Happened to My Computer? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Y}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 our important files are encrypted. \par \hich\af31502\dbch\af53\loch\f31502 Many of your documents, photos, videos, databases and other files are no longer accessibl\hich\af31502\dbch\af53\loch\f31502 e because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Can I Recover My Files? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 S}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ure. We guarantee that you can recover all y\hich\af31502\dbch\af53\loch\f31502 our files safely and easily. But you have not so enough time. \par \hich\af31502\dbch\af53\loch\f31502 You can decrypt some of your files for free. Try now by clicking <Decrypt>. \par \hich\af31502\dbch\af53\loch\f31502 But if you want to decrypt all your files, you need to pay. \par \hich\af31502\dbch\af53\loch\f31502 You only have 3 days to submit the payment. After that the\hich\af31502\dbch\af53\loch\f31502 price will be doubled. \par \hich\af31502\dbch\af53\loch\f31502 Also, if you don't pay in 7 days, you won't be able to recover your files forever. \par \hich\af31502\dbch\af53\loch\f31502 We will have free events for users who are so poor that they couldn't pay in 6 months. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 How Do I Pay? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 P}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ayment is accepted in Bitcoin only. For more i\hich\af31502\dbch\af53\loch\f31502 nformation, click <About bitcoin>. \par \hich\af31502\dbch\af53\loch\f31502 Please check the current price of Bitcoin and buy some bitcoins. For more information, click <How to buy bitcoins>. \par \hich\af31502\dbch\af53\loch\f31502 And send the correct amount to the address specified in this window. \par \hich\af31502\dbch\af53\loch\f31502 After your payment, click <Check Pay\hich\af31502\dbch\af53\loch\f31502 ment>. Best time to check: 9:00am - 11:00am GMT from Monday to Friday. \par \hich\af31502\dbch\af53\loch\f31502 Once the payment is checked, you can start decrypting your files immediately. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Contact \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 If you need our assistance, send a message by clicking <Contact Us>. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 We strongly recommend you to\hich\af31502\dbch\af53\loch\f31502 not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, it will not be able to recover your files even if you pay!}{ \rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid5268
URLs
-
http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect
Extracted
Path
-
C:\Users\Admin\Downloads\r.wnry
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named "%s". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
Targets
-
- Target http://pluh.com
Score10/10Wannacry
WannaCry is a ransomware cryptoworm.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Legitimate hosting services abused for malware hosting/C2
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
5