Overview

overview

10

Static

static

1

WannaCrypt0r.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WannaCrypt0r.zip

  • Size

    164KB

  • Sample

    240804-h6fe6szblr

  • MD5

    3d81b4fb7c398992fe64541b87cb4371

  • SHA1

    421cd4f856b14a854a06b4ee6104248c8cd981ed

  • SHA256

    8aa9d7b903cf5dde5ac5920640395fa5b0dfef09a4da50e084b7552d8ec21ba1

  • SHA512

    0b92b9b2d7026c00fa12b15fb2daa7ca493e8ce7e48e766b8e1e16d1c2a82cfdb5e4eafc82cddb1f6b5ec42a0422457565f510abacd06e0717a1ba74685f560c

  • SSDEEP

    3072:TlbxwVWSrh1lhL2ryplP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbwg3o:Ou6oeU3uokeOvHS1d1+sNs8wbiWQN91K

Score
10/10
cerberwannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___KLMVF75E_.txt

Family

cerber

Ransom Note
Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/815F-61C5-133F-0098-BBE6 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/815F-61C5-133F-0098-BBE6 2. http://xpcx6erilkjced3j.19kdeh.top/815F-61C5-133F-0098-BBE6 3. http://xpcx6erilkjced3j.1mpsnr.top/815F-61C5-133F-0098-BBE6 4. http://xpcx6erilkjced3j.18ey8e.top/815F-61C5-133F-0098-BBE6 5. http://xpcx6erilkjced3j.17gcun.top/815F-61C5-133F-0098-BBE6 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://xpcx6erilkjced3j.onion/815F-61C5-133F-0098-BBE6

http://xpcx6erilkjced3j.1n5mod.top/815F-61C5-133F-0098-BBE6

http://xpcx6erilkjced3j.19kdeh.top/815F-61C5-133F-0098-BBE6

http://xpcx6erilkjced3j.1mpsnr.top/815F-61C5-133F-0098-BBE6

http://xpcx6erilkjced3j.18ey8e.top/815F-61C5-133F-0098-BBE6

http://xpcx6erilkjced3j.17gcun.top/815F-61C5-133F-0098-BBE6

Targets

    • Target

      WannaCrypt0r.zip

    • Size

      164KB

    • MD5

      3d81b4fb7c398992fe64541b87cb4371

    • SHA1

      421cd4f856b14a854a06b4ee6104248c8cd981ed

    • SHA256

      8aa9d7b903cf5dde5ac5920640395fa5b0dfef09a4da50e084b7552d8ec21ba1

    • SHA512

      0b92b9b2d7026c00fa12b15fb2daa7ca493e8ce7e48e766b8e1e16d1c2a82cfdb5e4eafc82cddb1f6b5ec42a0422457565f510abacd06e0717a1ba74685f560c

    • SSDEEP

      3072:TlbxwVWSrh1lhL2ryplP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbwg3o:Ou6oeU3uokeOvHS1d1+sNs8wbiWQN91K

    Score
    10/10
    cerberwannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwareworm

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Contacts a large (1122) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks