Resubmissions

26/10/2026, 00:39

261026-az5gqaaz9s8

26/10/2026, 00:38

261026-azftcstwew6

25/10/2026, 05:36

261025-gaptasfy3m10

25/10/2026, 05:33

261025-f9ab8afy2p10

24/10/2026, 17:29

261024-v2vqhsv1fs10

24/10/2026, 17:23

261024-vx9c4sv1ds10

24/10/2026, 17:18

261024-vvlh9scz4k10

24/10/2026, 05:51

261024-gkjd9shz8j10

24/10/2026, 05:48

261024-ghggwshz7k10

24/10/2026, 04:35

261024-e72s1sfx7x10

General

  • Target
    https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
  • Sample261024-vx9c4sv1ds

Malware Config

Extracted

Path
  • C:\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

    • Target
      https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
    • Family: Wannacry

      WannaCry is a ransomware cryptoworm.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks