Overview

overview

10

Static

static

1

tiktok_liv...1).exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

6

$PLUGINSDI...in.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ro.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    tiktok_live_studio_downloader-v0.0.1-wid-97c1aDZO62u (1).exe
  • Size 3.9MB
  • Sample260801-kwj2qagm4y
  • SHA256 cee0b19b7471f026dcf4d04c31e36ce5f3d4c29999e980a2276e2f8838eaa167
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
badrabbitmimikatzwannacryadwaredefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerworm

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

    • Target
      tiktok_live_studio_downloader-v0.0.1-wid-97c1aDZO62u (1).exe
    • Size 3.9MB
    • SHA256 cee0b19b7471f026dcf4d04c31e36ce5f3d4c29999e980a2276e2f8838eaa167
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionbadrabbitmimikatzwannacryimpactpersistenceprivilege_escalationransomwarespywarestealerworm

    • Family: BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Family: Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Family: Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • mimikatz is an open source tool to dump credentials on Windows

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Adds Run key to start application

      persistence

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Downloads MZ/PE file

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 111KB
    • SHA256 e946aaee3ea4d75b54e8e7b6d874c2d149189141a3523e14fb413fad3973410d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 23KB
    • SHA256 d0eedaa4bf4a3e54164658aebcd4eb9d7b18614603afb193541229af575641eb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarediscoverypersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3
    • Target
      $PLUGINSDIR/nsis_plugin.dll
    • Size 2.1MB
    • SHA256 521237d8ce53cbe6b25547e6f8d4bbf31e2c88390d1ddb7d6cf505158da6bded
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/shell_downloader_pro.dll
    • Size 2.4MB
    • SHA256 d4beec6ead090290faa5188655c37592034431b75877a10649fe68a12d391f50
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks