Overview

overview

10

Static

static

3

infinity source.zip

windows7-x64

1

infinity source.zip

windows10-2004-x64

1

source/LICENSE

windows7-x64

1

source/LICENSE

windows10-2004-x64

1

source/README.md

windows7-x64

3

source/README.md

windows10-2004-x64

3

source/source.zip

windows7-x64

1

source/source.zip

windows10-2004-x64

1

ed01ebfbc9...aa.exe

windows7-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    infinity source.zip

  • Size

    3.3MB

  • Sample

    240726-xszdfsydqk

  • MD5

    45b0507454fc91e875c0358084356b1a

  • SHA1

    b99e28f33144a88beb25de3182c4c3b0ac8b0849

  • SHA256

    a61e349cbc8b75ffd686b26ece1a562a86dca6da429864a5ededc8f1f212ed09

  • SHA512

    81031afee0892dd71bbe3a0b787a9bb100e7101636e954bb18b3efe04b162c2b5f6d5af353232786ea0f586f81a71cd3dc8697ebb10ceb59550dcfa7a65feeb7

  • SSDEEP

    98304:Jhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRU:Jhvq7Bu6EZnZN5EyBS6

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      infinity source.zip

    • Size

      3.3MB

    • MD5

      45b0507454fc91e875c0358084356b1a

    • SHA1

      b99e28f33144a88beb25de3182c4c3b0ac8b0849

    • SHA256

      a61e349cbc8b75ffd686b26ece1a562a86dca6da429864a5ededc8f1f212ed09

    • SHA512

      81031afee0892dd71bbe3a0b787a9bb100e7101636e954bb18b3efe04b162c2b5f6d5af353232786ea0f586f81a71cd3dc8697ebb10ceb59550dcfa7a65feeb7

    • SSDEEP

      98304:Jhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRU:Jhvq7Bu6EZnZN5EyBS6

    Score
    1/10
    behavioral1behavioral2

    • Target

      source/LICENSE

    • Size

      34KB

    • MD5

      84dcc94da3adb52b53ae4fa38fe49e5d

    • SHA1

      12d81f50767d4e09aa7877da077ad9d1b915d75b

    • SHA256

      589ed823e9a84c56feb95ac58e7cf384626b9cbf4fda2a907bc36e103de1bad2

    • SHA512

      552aec8d120c9d931769f6a6b794716fce978d0055715de21746dc0f064f4a0f72b6be42d4828b98a56715b23fa427c1f66fd20aca0ef1751cc384c420db1605

    • SSDEEP

      768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9I7dB:MhcycsrfrnouW

    Score
    1/10
    behavioral3behavioral4

    • Target

      source/README.md

    • Size

      70B

    • MD5

      39148bc21924851d9082b687dc69e2dc

    • SHA1

      5d1e5490476227aa8877b87aad184031e19dc33a

    • SHA256

      76a94c98df32a1d37cc7f1e2b86bdc524eda3fedcdb35e57de0dd56bd976142f

    • SHA512

      2415bb9de017c086abf8315e4288a04d5eb6048af2637e75843778f24de6834154b68365794b6cbc09ef5da0fe96d5bfce20227bf3656d23b7f148fb60988041

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      source/source.zip

    • Size

      3.3MB

    • MD5

      efe76bf09daba2c594d2bc173d9b5cf0

    • SHA1

      ba5de52939cb809eae10fdbb7fac47095a9599a7

    • SHA256

      707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

    • SHA512

      4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

    • SSDEEP

      98304:vhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRT:vhvq7Bu6EZnZN5EyBSN

    Score
    1/10
    behavioral7behavioral8

    • Target

      ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

    • Size

      3.4MB

    • MD5

      84c82835a5d21bbcf75a61706d8ab549

    • SHA1

      5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

    • SHA256

      ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

    • SHA512

      90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

    • SSDEEP

      98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

    Score
    10/10
    wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

2
T1490

Tasks