General

  • Target

    2025-02-07_a17fe664009d09499b6931cf2e0f8435_neshta_wannacry

  • Size

    264KB

  • Sample

    250208-n7q6ysvmfq

  • MD5

    a17fe664009d09499b6931cf2e0f8435

  • SHA1

    0dada95eb81bb92961093e1871124b5ee3d924f3

  • SHA256

    52e6033b88774fb82f111442886751a107a636d9e0c8b392aee4e19340dc656c

  • SHA512

    268f4f841e18b90b107a64c263b71a6cad4234c4f36258efee638f1d61005d7d75c1c1d9b752e19e2a6a456a6ad003419633f9b1fc1538323d975ba4e1877e22

  • SSDEEP

    3072:sr85CcTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efcx59femWRJ:k9cTs/dSXj84mRXPemxdBlPvLzLek5RJ

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

    • Target

      2025-02-07_a17fe664009d09499b6931cf2e0f8435_neshta_wannacry

    • Size

      264KB

    • MD5

      a17fe664009d09499b6931cf2e0f8435

    • SHA1

      0dada95eb81bb92961093e1871124b5ee3d924f3

    • SHA256

      52e6033b88774fb82f111442886751a107a636d9e0c8b392aee4e19340dc656c

    • SHA512

      268f4f841e18b90b107a64c263b71a6cad4234c4f36258efee638f1d61005d7d75c1c1d9b752e19e2a6a456a6ad003419633f9b1fc1538323d975ba4e1877e22

    • SSDEEP

      3072:sr85CcTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efcx59femWRJ:k9cTs/dSXj84mRXPemxdBlPvLzLek5RJ

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Wannacry family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks