Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://bing.com

windows10-2004-x64

10

Resubmissions

08-08-2024 19:16

240808-xy85vaxhkl 3

08-08-2024 15:19

240808-sqh68syfqa 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://bing.com

  • Sample

    240808-sqh68syfqa

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerupxvmprotectworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\TMRDTSelfExtract\HLUI\ScanPage\common\main.html

Ransom Note
Ransomware File Decryptor Anti-Ransomware Trend Micro experts help you decrypt your encrypted files Select the ransomware name Select the encrypted file or folder to start decrypting it Your selected files do not match. Please try again. Select your screen font color: Pleaes enter your personal decryption code: This scan can take significant time. DO NOT close this window or turn off your computer until the scan completes. IMPORTANT: Files encrypted with CryptXXX V3 cannot be completely recovered. Some parts of each file could be left encrypted. To repair your decrypted file, follow the guide on Trend Micro Support Website IMPORTANT: Files encrypted with Cerber cannot be completely recovered. Some parts of each file could be left encrypted. To repair your decrypted file, follow the guide on Trend Micro Support Website Some files need more information to continue. Click here. Scan Completed Duration: 00:00:00 Infected Files: 0 Decrypted Files: 0 See decrypted files Some files appear to be infected with CryptXXX V1. To continue, select any infected file (maximum file size recommended), and a non-infected copy of the same file. Make sure their file sizes are same. Some files appear to be infected with CryptXXX V1. To continue, select any infected file (maximum file size recommended), and a non-infected copy of the same file. Make sure their file sizes are same. Some files appear to be infected with CryptXXX V1. To continue, select any infected file (maximum file size recommended), and a non-infected copy of the same file. Make sure their file sizes are same. Some files appear to be infected with CryptXXX V1. To continue, select any infected file (maximum file size recommended), and a non-infected copy of the same file. Make sure their file sizes are same. Some files appear to be infected with CryptXXX V1. To continue, select any infected file (maximum file size recommended), and a non-infected copy of the same file. Make sure their file sizes are same. What‘s ID and Email? Your selected files do not match. Please try again. Trend Micro Support Website Feedback

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

    • Target

      http://bing.com

    Score
    10/10
    wannacrydefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerupxvmprotectworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks