wannacry

Sharing

Copy URL

Twitter E-mail

General

Target

LCrypt0rX with other malwares.zip
Size

3.9MB
Sample

241025-slwlrsymgz
MD5

0810a09835fc90e6dbbfbde47e83eed5
SHA1

d10b4ebecf624b58fa25ddb2b20c8f5685f14459
SHA256

80c5e8f13d838fd509ddb0eaa4daf63c8d09b4d34556794cbcaec20875210208
SHA512

8ca263e1883c4527f88394d570d69639a9b3531a469df77bc631707f8a1344e3cc434ed1076772d77e9f7444a238ef71e92e9f1ef7f54adc25912ccc5d839191
SSDEEP

98304:x1Oov2G2fDGC95OZmwApnWUxULgv2LIPfy3:nPYfCcwAYUqL8vPfy3

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\other malware cuz why not\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\other malware cuz why not\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
- Size
  
  21KB
- MD5
  
  ccfb22a0d55543947874bc9b607c7843
- SHA1
  
  b956bda2cb1484dd81a858a20b6f352738b7520a
- SHA256
  
  709f205ac793546c11dab288eebec677f14b61c1e290ba48c8694e199c55ec42
- SHA512
  
  987888a30fdd10957c00c0cf34197ff9e261dc364251a778e758248a298782555b071b1a9ac693d253ae91a3ee72c2bb4114a9462fc3fe9e574752eaa9b82a06
- SSDEEP
  
  384:tegbplStxYHQHSH7l+icj1F2Z2vXQayXwA+9xQ+E6z:b2T2hJ+Em
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Blocklisted process makes network request
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Disables RegEdit via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  
  Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
- Size
  
  20KB
- MD5
  
  f753ea95369f3e832878635b6dc67762
- SHA1
  
  3429ced1cd3c69df443b42b0bcb11dfc004a4d71
- SHA256
  
  7004313d3ed3cc1277c3c13621f3de8523584977ddfd089bc8f494213dce566e
- SHA512
  
  4d08e07b613099f961682bac2d46938017445859fae95c53d00afeab4525bea170d49ef3bbedea461a37b6201cc82196366dadada97ad3620a558d763b9f0b88
- SSDEEP
  
  384:teGbplStxYHQHSH7l+icj1F2Z2vXQayXwA+9xQ+E6O:l2T2hJ+EF
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Blocklisted process makes network request
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Disables RegEdit via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  
  other malware cuz why not/[email protected]
- Size
  
  3.4MB
- MD5
  
  84c82835a5d21bbcf75a61706d8ab549
- SHA1
  
  5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
- SHA256
  
  ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- SHA512
  
  90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
- SSDEEP
  
  98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  
  other malware cuz why not/NoEscape.exe
- Size
  
  666KB
- MD5
  
  989ae3d195203b323aa2b3adf04e9833
- SHA1
  
  31a45521bc672abcf64e50284ca5d4e6b3687dc8
- SHA256
  
  d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
- SHA512
  
  e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
- SSDEEP
  
  12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  
  other malware cuz why not/loveletterworm.vbs
- Size
  
  10KB
- MD5
  
  d94e46e40f5663dd698dad3369f1f782
- SHA1
  
  9c511b8ddf0c2c9ce9c32d92cdf60c1e3d1c8abf
- SHA256
  
  bc39d64a797497d2e0e6cd498f7b84c6fa2464cc7dc29114ef9af438089c5f25
- SHA512
  
  07e6f98ba6374f68886f9f642598744b91954a76e1b23fdb9ece89835b596d9bde68c96eedf5f2bbbad3d53b84b7d1dd231ebb9e8d9757996d2779b4c802bd02
- SSDEEP
  
  192:brjZcrmlHV31G7sMBMLMLMiMhM5MmMhMrMXM57Mksc/021wqIVCPsz87sGdOVRJS:brjOi1V31GoIGWFqAHqi407/sX/pVCdV
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20