Overview

overview

10

Static

static

3

spoofer/Ac...on.exe

windows10-2004-x64

10

spoofer/Se...er.bat

windows10-2004-x64

1

spoofer/Spoofer.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spoofer.zip

  • Size

    9.6MB

  • Sample

    250101-ql1vdawlav

  • MD5

    84f50dae58e7baeb906603c1040e47a9

  • SHA1

    152a3b451f3f01350cd4394057c1ee75f41d36c0

  • SHA256

    95978fcb67a1110a96f207d752ed46ef5fe0a150247ddd043bc5ae6ed67fc4ac

  • SHA512

    bd07a7d83af33ca34984356323af1820c9cd2f85eca9618e133443e0f5ee79d4c3ddc6c9ab9fcbf3229b04f2c649d9f2099bfdafa3415d05d5ce35620bfc5109

  • SSDEEP

    196608:EkJ69Jx55LN08owIXHFbPd8QiV5UhbwwOAPr8n4TFNz3ukZ2qD:ElxB0lxiVMbwhAonENz3LZz

Score
10/10
wannacrydefense_evasiondiscoveryexecutionexploitimpactpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      spoofer/Activation.exe

    • Size

      703KB

    • MD5

      8c1d40db6464fd098716a317486db961

    • SHA1

      4b4d82e0a91f11e1348488b9e9edd43697d9db67

    • SHA256

      7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5

    • SHA512

      16c868e227c4928dfcc116ba6e9d93c22418936cad625cd48645abb96229d31ee1329105097d2e7f36f6382e214dfd54e1eb92842bcc45edd978f64da6c4c6dd

    • SSDEEP

      6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXWwm:5mV620nN8ZoAutZeiXhOBuOaBToo4ZY

    Score
    10/10
    wannacrydefense_evasiondiscoveryexecutionexploitimpactpersistenceransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Possible privilege escalation attempt

      exploit

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

    • Target

      spoofer/Serials_Checker.bat

    • Size

      771B

    • MD5

      f7f6aab3d1c377eb69e9b786cd22a50b

    • SHA1

      e6f9c2b61c6df03bd3818ede183b6aacdfafa1ba

    • SHA256

      f95d45eb40e7e4ce5f81c5cfca4232d81e9210a3b6743bbe196b4443cf5783d9

    • SHA512

      9322513e26aab226ca9a35e5bc3793a9f580712be284970d381917f0f953b95587707d37e4a09927db97149f5310b73be0dc46262be83b53205ef4ddf4778b8a

    Score
    1/10
    behavioral2

    • Target

      spoofer/Spoofer.exe

    • Size

      9.5MB

    • MD5

      133d9d8901105e6b12d6c6b6bd24dd4a

    • SHA1

      a659f144a5bdc5ac15972da821a1a1fcb095c375

    • SHA256

      e2819114f1167b92939d08b19a4a0feb5997baf62a293b08735eecf863ce4f7c

    • SHA512

      0acae7ae4bfd69fab1d092494bbab8b70c8f407bb2992c8b049b05eccf284f473cb77602e984c9d8a1ab313ad66d44e497b9e1e3ee00744e37df820cd264bed3

    • SSDEEP

      196608:edHWUd/RF+SwgZyBP6v/m6bCJuzOTvbPVauYzIHHSqGJeorUe:edHPJYgZI5688OTvzAmnS9h

    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks