Overview

overview

10

Static

static

10

Payload/Bl...nd.png

windows10-2004-x64

1

Payload/Bl...21.png

windows10-2004-x64

1

Payload/Bl..._1.png

windows10-2004-x64

1

Malware-1-...an.bat

windows10-2004-x64

7

Malware-1-...ve.exe

windows10-2004-x64

7

Malware-1-...ya.exe

windows10-2004-x64

Malware-1-...ry.exe

windows10-2004-x64

10

Malware-1-...ck.exe

windows10-2004-x64

3

Malware-1-...op.exe

windows10-2004-x64

7

Malware-1-...ue.exe

windows10-2004-x64

3

Resubmissions

22/11/2025, 17:35

251122-v57jgsbn8x10

22/11/2025, 17:26

251122-vz93esbn4z

22/11/2025, 17:15

251122-vsrmhabm4v10

22/11/2025, 17:02

251122-vkblbavldp10

22/11/2025, 16:57

251122-vggyxsvkgr10

22/11/2025, 16:49

251122-vb6ebsbk5110

22/11/2025, 13:45

251122-q2m88aaj4t10

21/11/2025, 21:15

251121-z4cpyagj3w

12/11/2025, 03:22

251112-dw9ttaxrgx10

Sharing

Copy URL Twitter E-mail

General

  • Target
    251028-vkjxpaxrap_pw_infected.zip
  • Size 45.4MB
  • Sample251122-vggyxsvkgr
  • SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
petyawannacryxmrigadwarebootkitdefense_evasiondiscoveryexecutionimpactinstallerminerpersistenceransomwarespywarestealerupxvmprotectworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

    • Target
      Payload/Blocked.app/background.png
    • Size 171KB
    • SHA256 c8fd4736029e27ca9ed216748204a1fb560eb297dd85521fa2b757b7bf5ee6b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      Payload/Blocked.app/blockgoal21.png
    • Size 9KB
    • SHA256 cfb9bb60e5fe95cf80e214fdd76ca3ffdc12448bb87a6a5d2fd5545af8f83e8c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral2
    • Target
      Payload/Blocked.app/difficultybutton_1.png
    • Size 3KB
    • SHA256 b6e1c6321e58a651275210c64e98ead1c56c9c48886ee3c52d6c2fa4710ed648
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3
    • Target
      Malware-1-master/MEMZ-Clean.bat
    • Size 9KB
    • SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral4
    • Target
      Malware-1-master/MEMZ-Destructive.exe
    • Size 14KB
    • SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral5
    • Target
      Malware-1-master/Petya.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bootkitpetyapersistenceransomware

    • Detects Petya Ransomware

      ransomware

    • Petya

      Petya is a ransomware written in C#.

      ransomwarepetya

    • Petya family

      petya

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral6
    • Target
      Malware-1-master/WannaCry.EXE
    • Size 3.4MB
    • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral7
    • Target
      Malware-1-master/Win32.EvilClusterFuck.exe
    • Size 64KB
    • SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral8
    • Target
      Malware-1-master/butterflyondesktop.exe
    • Size 2.8MB
    • SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryinstallerpersistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral9
    • Target
      Malware-1-master/eternalblue.exe
    • Size 886KB
    • SHA256 7f5f447fe870449a8245e7abc19b9f4071095e02813d5f42c622add56da15b8b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    adwarespyware
    behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks