Resubmissions
28/01/2025, 02:17
250128-cq1hhstnex 1024/01/2025, 18:40
250124-xa9rgaskbs 1024/01/2025, 18:35
250124-w8pzaa1rhw 1024/01/2025, 12:51
250124-p3g8xs1jel 1024/01/2025, 12:43
250124-pyay2synew 1024/01/2025, 12:32
250124-pqtq7azmhk 1024/01/2025, 07:13
250124-h2fkdawnft 1022/01/2025, 14:16
250122-rk6jxaznbz 10General
-
Target
freehacks.exe
-
Size
105.5MB
-
Sample
250124-pqtq7azmhk
-
MD5
4647bc264b4344c7ca47ae9adc130ba9
-
SHA1
08280768ffd55e06203fc8f13d3e6f1745c7ee0c
-
SHA256
742e3f0ca6967c947c99cbbff7f3eaa7f5059a1bba1714a20afee3d85312a439
-
SHA512
9d2a9f90746e74819c441da86086fc716f2e9f54fbf77e4a1cfec2badb1d64b9fe0ba3e3f5304ad797613c27cb038fbddc551d4824b6445ab5f8d063e1424981
-
SSDEEP
3145728:iZGbexf7I4RniT0BEI43vBrYwY+pOhdFs8rBb:isbexTi64/Bbp0KG
Static task
static1
Malware Config
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
C:\NPSTULYC-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/7d1bd758d8deb62a
Targets
-
-
Target
freehacks.exe
-
Size
105.5MB
-
MD5
4647bc264b4344c7ca47ae9adc130ba9
-
SHA1
08280768ffd55e06203fc8f13d3e6f1745c7ee0c
-
SHA256
742e3f0ca6967c947c99cbbff7f3eaa7f5059a1bba1714a20afee3d85312a439
-
SHA512
9d2a9f90746e74819c441da86086fc716f2e9f54fbf77e4a1cfec2badb1d64b9fe0ba3e3f5304ad797613c27cb038fbddc551d4824b6445ab5f8d063e1424981
-
SSDEEP
3145728:iZGbexf7I4RniT0BEI43vBrYwY+pOhdFs8rBb:isbexTi64/Bbp0KG
-
Gandcrab family
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
1