cryptolocker

General

Target

Bloxxed_v1 (1).exe
Size

172KB
Sample

241217-tneayatnbm
MD5

66ddf5e574409a5999cc1dc528cc200a
SHA1

fd10666096fd8f56f7ff43fc13206a67d417c290
SHA256

56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3
SHA512

e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc
SSDEEP

3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  Bloxxed_v1 (1).exe
- Size
  
  172KB
- MD5
  
  66ddf5e574409a5999cc1dc528cc200a
- SHA1
  
  fd10666096fd8f56f7ff43fc13206a67d417c290
- SHA256
  
  56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3
- SHA512
  
  e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc
- SSDEEP
  
  3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs
Score

10^/10

cryptolocker wannacry defense_evasion discovery evasion execution impact motw persistence phishing ransomware spyware stealer trojan worm
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Cryptolocker family
  cryptolocker
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Sets desktop wallpaper using registry
  ransomware
behavioral1