killmbr | 9457c0bfe89e200e83aea978ab8c7eb4685d4947d759e1c70848b4d3cb69c998

General

Target
c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07.zip
Size 4.3MB
Sample260708-jaysbacw4s
SHA256 9457c0bfe89e200e83aea978ab8c7eb4685d4947d759e1c70848b4d3cb69c998
MD5 9f7874fa7886cab981a5dfa4f8a03bf3
SHA1 7e1263ec7d363bdc17ca790f3156327d1282ccee
SHA512 ca292d7a99a4106871f682048499f5101fec3f94077ac6ced9f0ed0358b6bada9589ea3a66da8c7d01ea0dff5695991fb6123d7f8bdacad7513fdbaa1f0ca99d
SSDEEP 98304:g1XvnzngAlMXIpGQYJKSdrJQ5DCR9WRAVV4PXHccQ:g1X/zngYbYJKSdrJQ5OvOscQ
TLSH
T1D92633CFAD1085FB7C245ABBF80376F4DF5195708D1E614B338144638A63A64E86E2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\@[email protected]

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07.exe
- Size 4.3MB
- SHA256 c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07
- MD5 e1c3b51e85583197055cc32270a110e1
- SHA1 22b77310e703ab819ac1ffd2335a93e8116b3319
- SHA512 4374dcd71c9fa6271e5a92c45d24f17331d2543cb03a6966a0a9e59848f30d62210e22e37ffb1b2c4f55817a8ee3ff362808550e98ebdbe1c0387a030a3e2f7c
- SSDEEP 98304:zK70czp1bzpQ3cVmKdezCrH/0suAAjnswHtRt1tJSHo0:mNbzp2cjOCWAIswHtRt1tJB
- TLSH
  T14C26337C86B8C56DC9270EFBC7F996BFC6017939D146E207A85BAE9636170940843F8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit killmbr wannacry persistence ransomware trojan wiper worm
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1