Overview

overview

10

Static

static

3

eeeeeeeeee...00.exe

windows7-x64

eeeeeeeeee...um.exe

windows7-x64

10

eeeeeeeeee...ug.exe

windows7-x64

6

eeeeeeeeee...le.exe

windows7-x64

3

eeeeeeeeee...er.exe

windows7-x64

7

eeeeeeeeee...us.exe

windows7-x64

3

MEMZ 3.0/MEMZ.bat

windows7-x64

7

MEMZ 3.0/MEMZ.exe

windows7-x64

6

eeeeeeeeee...MZ.bat

windows7-x64

7

eeeeeeeeee...MZ.exe

windows7-x64

6

eeeeeeeeee...ld.exe

windows7-x64

3

eeeeeeeeee....A.exe

windows7-x64

6

eeeeeeeeee...al.exe

windows7-x64

7

eeeeeeeeee...15.exe

windows7-x64

3

eeeeeeeeee...al.exe

windows7-x64

7

eeeeeeeeee...0r.exe

windows7-x64

10

eeeeeeeeee...ro.exe

windows7-x64

eeeeeeeeee...od.exe

windows7-x64

10

eeeeeeeeee...ts.dll

windows7-x64

1

eeeeeeeeee...ts.dll

windows7-x64

3

eeeeeeeeee...ot.exe

windows7-x64

3

Resubmissions

15/09/2024, 23:15

240915-28re1axhpn

15/09/2024, 23:12

240915-27aqvsxhjq8

15/09/2024, 23:02

240915-21efgaxake8

15/09/2024, 22:58

240915-2xypyaxdkj3

15/09/2024, 22:56

240915-2wn44sxcpk3

15/09/2024, 22:43

240915-2np2fawhpr3

15/09/2024, 22:42

240915-2m3k5swhmk10

15/09/2024, 22:33

240915-2gqdmawbja8

15/09/2024, 22:27

240915-2de4gswekk7

15/09/2024, 22:15

240915-16esravenh10

Sharing

Copy URL Twitter E-mail

General

  • Target
    eeeeeeeeeeeeee.zip
  • Size 82.4MB
  • Sample240915-2m3k5swhmk
  • SHA256 734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wannacrybootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://93.115.82.248/?0=1&1=1&2=9&3=i&4=7601&5=1&6=1111&7=vkpukwcwav

Targets

    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/000/[email protected]
    • Size 6.7MB
    • SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoveryevasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Antivirus Platinum/[email protected]
    • Size 739KB
    • SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasiontrojanupx

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan
    behavioral2
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/ColorBug/[email protected]
    • Size 53KB
    • SHA256 775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    persistence
    behavioral3
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/DesktopPuzzle/[email protected]
    • Size 239KB
    • SHA256 1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral4
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/FakeActivation/[email protected]
    • Size 396KB
    • SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral5
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Happy Antivirus/[email protected]
    • Size 1.9MB
    • SHA256 64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral6
    • Target
      MEMZ 3.0/MEMZ.bat
    • Size 12KB
    • SHA256 5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoveryexecutionpersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral7
    • Target
      MEMZ 3.0/MEMZ.exe
    • Size 12KB
    • SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral8
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/MEMZ 3.0 (1)/MEMZ 3.0/MEMZ.bat
    • Size 12KB
    • SHA256 5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoveryexecutionpersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral9
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/MEMZ 3.0 (1)/MEMZ 3.0/MEMZ.exe
    • Size 12KB
    • SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral10
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/NavaShield/[email protected]
    • Size 9.7MB
    • SHA256 83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Petya.A/[email protected]
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral12
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Central/[email protected]
    • Size 904KB
    • SHA256 90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistencespywarestealerupx

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral13
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Defender 2015/[email protected]
    • Size 1.2MB
    • SHA256 415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral14
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/VineMEMZ-Original.exe
    • Size 39.6MB
    • SHA256 5f6a8f0e85704eb30340a872eec136623e57ab014b4dd165c68dd8cd76143923
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral15
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/WannaCrypt0r/[email protected]
    • Size 3.4MB
    • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral16
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Windows Accelerator Pro/[email protected]
    • Size 1023KB
    • SHA256 69461917822ca791194992d7b7d01e12afbf0eb86ae327b3fb86df01012e060e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryevasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral17
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Winlocker.VB6.Blacksod/[email protected]
    • Size 2.4MB
    • SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral18
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/YouAreAnIdiot/AxInterop.ShockwaveFlashObjects.dll
    • Size 17KB
    • SHA256 0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/YouAreAnIdiot/Interop.ShockwaveFlashObjects.dll
    • Size 21KB
    • SHA256 63af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral20
    • Target
      eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/YouAreAnIdiot/YouAreAnIdiot.exe
    • Size 424KB
    • SHA256 1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

11
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

2
T1490

Tasks

static1

Score
3/10

behavioral1

discoveryevasionpersistenceransomware
Score
8/10

behavioral2

discoveryevasiontrojanupx
Score
10/10

behavioral3

persistence
Score
6/10

behavioral4

discovery
Score
3/10

behavioral5

discoverypersistence
Score
7/10

behavioral6

discovery
Score
3/10

behavioral7

bootkitdiscoveryexecutionpersistence
Score
7/10

behavioral8

bootkitdiscoverypersistence
Score
6/10

behavioral9

bootkitdiscoveryexecutionpersistence
Score
7/10

behavioral10

bootkitdiscoverypersistence
Score
6/10

behavioral11

discovery
Score
3/10

behavioral12

bootkitpersistence
Score
6/10

behavioral13

discoverypersistencespywarestealerupx
Score
7/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
7/10

behavioral16

wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral17

defense_evasiondiscoveryevasionpersistencetrojan
Score
10/10

behavioral18

discoverypersistence
Score
10/10

behavioral19

Score
1/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10