General

  • Target

    Skärmbild 2024-01-01 214243.png

  • Size

    325KB

  • Sample

    250518-wkcztawm18

  • MD5

    06c944901cf04ab82354e6605c5ea928

  • SHA1

    053a6f7c743ae5080facca7c9bbc66fa6a06e5ce

  • SHA256

    14bf5b30bb1c7a7c1b9456b3c5b0a1c45ea43f89eed0c9f74b5155abf28a3689

  • SHA512

    78559130484341bf9eef2ec2a393ae8d3e8ba943718e73aba465571a5f7d92d326f97100965e882d7a99ffbc78a85fb1ed884657faf6b87259213ad53f635e23

  • SSDEEP

    6144:73vArMcSXzbpHCD0OE9hHAPDLaoqucA/eLx0NrvxO99DtsFMFCYnhG:7Y4c4zbpiAOErgrLaoB/mx0NrvxOnpeB

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      Skärmbild 2024-01-01 214243.png

    • Size

      325KB

    • MD5

      06c944901cf04ab82354e6605c5ea928

    • SHA1

      053a6f7c743ae5080facca7c9bbc66fa6a06e5ce

    • SHA256

      14bf5b30bb1c7a7c1b9456b3c5b0a1c45ea43f89eed0c9f74b5155abf28a3689

    • SHA512

      78559130484341bf9eef2ec2a393ae8d3e8ba943718e73aba465571a5f7d92d326f97100965e882d7a99ffbc78a85fb1ed884657faf6b87259213ad53f635e23

    • SSDEEP

      6144:73vArMcSXzbpHCD0OE9hHAPDLaoqucA/eLx0NrvxO99DtsFMFCYnhG:7Y4c4zbpiAOErgrLaoB/mx0NrvxOnpeB

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Wannacry family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (105) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies RDP port number used by Windows

    • Patched UPX-packed file

      Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks