Overview

overview

10

Static

static

1

LDPlayer9_...ld.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LDPlayer9_vn_1003_CjwKCAjw1emzBhB8EiwAHwZZxWtNl3IEA0x9sc31PjIzcdYfkNjH0wcWdDj2avCzD0lx7NJQYWFR7RoCn4kQAvD_BwE_ld.exe

  • Size

    12.3MB

  • Sample

    240626-fh5daawdkh

  • MD5

    757987a8437039276dad42102cba8f23

  • SHA1

    9a1ba7bdf9ecc849525bb099bbd9d277dd46da15

  • SHA256

    e3e2b21dee0127cb9ea06ae7184665284d36413d38146c252bf6fd8812e600ae

  • SHA512

    9ebab1a503184ce029c319413c4c0698ee3ae0a71d3363f191b3464f7ab7b35d561c36489478bb481c734974ff3f469f4e3d5e0c553c7af88341dc2950af19a6

  • SSDEEP

    393216:nBHhaxbxp41TXj2w5311sHznZc+TEI4gw6:B8bxWT6w5AbZbTNC

Score
10/10
wannacrybootkitdefense_evasiondiscoveryexecutionexploitimpactpersistenceprivilege_escalationransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      LDPlayer9_vn_1003_CjwKCAjw1emzBhB8EiwAHwZZxWtNl3IEA0x9sc31PjIzcdYfkNjH0wcWdDj2avCzD0lx7NJQYWFR7RoCn4kQAvD_BwE_ld.exe

    • Size

      12.3MB

    • MD5

      757987a8437039276dad42102cba8f23

    • SHA1

      9a1ba7bdf9ecc849525bb099bbd9d277dd46da15

    • SHA256

      e3e2b21dee0127cb9ea06ae7184665284d36413d38146c252bf6fd8812e600ae

    • SHA512

      9ebab1a503184ce029c319413c4c0698ee3ae0a71d3363f191b3464f7ab7b35d561c36489478bb481c734974ff3f469f4e3d5e0c553c7af88341dc2950af19a6

    • SSDEEP

      393216:nBHhaxbxp41TXj2w5311sHznZc+TEI4gw6:B8bxWT6w5AbZbTNC

    Score
    10/10
    wannacrybootkitdefense_evasiondiscoveryexecutionexploitimpactpersistenceprivilege_escalationransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Creates new service(s)

      persistenceexecution

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Possible privilege escalation attempt

      exploit

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks