Resubmissions

04-07-2024 11:28

240704-nlal3sycra 10

03-07-2024 20:16

240703-y2dnsaxflh 3

03-07-2024 20:08

240703-ywwmeawbnp 10

03-07-2024 20:07

240703-ywad6sxdqg 3

03-07-2024 20:02

240703-ysff1swakk 6

03-07-2024 20:02

240703-yr5draxcng 3

03-07-2024 20:01

240703-yryk7sxcna 3

03-07-2024 19:57

240703-ypp62sxbne 3

03-07-2024 19:55

240703-ynf7ravgnn 3

General

  • Target

    AutoDox.exe

  • Size

    81KB

  • Sample

    240703-ywwmeawbnp

  • MD5

    ec51cfbde4a4df4eceb8313adf8d93ca

  • SHA1

    f8925a067c34ab1b0e7da2de961af20247ace3fa

  • SHA256

    aef13f3ec8abf777929e42aa3de86774ab8362f7fbfcc0475c7b912ce253c002

  • SHA512

    1cc6c73c33ce6d00c102f9ed3c6733c532f131b00761fd4ff59cda87c560e3ce3e06dfcbb8a886976ae5084c9d36c3f02d9afefca5b1403c20b53735fe24bada

  • SSDEEP

    1536:9rsgf4VFHlI++UIoyjyCL6sf+Fle8Ifvl1loJbh76e:ClI++UIZIsf+Fle8Ift1loJbh76

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      AutoDox.exe

    • Size

      81KB

    • MD5

      ec51cfbde4a4df4eceb8313adf8d93ca

    • SHA1

      f8925a067c34ab1b0e7da2de961af20247ace3fa

    • SHA256

      aef13f3ec8abf777929e42aa3de86774ab8362f7fbfcc0475c7b912ce253c002

    • SHA512

      1cc6c73c33ce6d00c102f9ed3c6733c532f131b00761fd4ff59cda87c560e3ce3e06dfcbb8a886976ae5084c9d36c3f02d9afefca5b1403c20b53735fe24bada

    • SSDEEP

      1536:9rsgf4VFHlI++UIoyjyCL6sf+Fle8Ifvl1loJbh76e:ClI++UIZIsf+Fle8Ift1loJbh76

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks