wannacry

General

Target

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.zip
Size

136KB
Sample

220824-r4qb2aegdn
MD5

f00d7fabef4ae84f088b7aa072cb530b
SHA1

0908b2867adbf4cd769d1fb9dda5b95438515e68
SHA256

c13e4b910efd039bd609f939e9c75f5afdefbd297d6f6bb441bf51e11dfe2b21
SHA512

00b3a97a1c6f7e16b68134447f59f075b280aafa3973da6d99121db96d1ee5734e68a395c88b1106bc36e60e1af5e54c8311c5f5adebcdc2236f8dfeee3634d4
SSDEEP

3072:WTpRTt+G99RgFl9kD61BOuLpm0MGOyni4g9OTU0K7KsKOuu1p6DuqRIlUvvoR3Z7:Y/9RgFl9bDuqGyvvoRJGRJRRJLRJuOlS

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.zip
- Size
  
  136KB
- MD5
  
  f00d7fabef4ae84f088b7aa072cb530b
- SHA1
  
  0908b2867adbf4cd769d1fb9dda5b95438515e68
- SHA256
  
  c13e4b910efd039bd609f939e9c75f5afdefbd297d6f6bb441bf51e11dfe2b21
- SHA512
  
  00b3a97a1c6f7e16b68134447f59f075b280aafa3973da6d99121db96d1ee5734e68a395c88b1106bc36e60e1af5e54c8311c5f5adebcdc2236f8dfeee3634d4
- SSDEEP
  
  3072:WTpRTt+G99RgFl9kD61BOuLpm0MGOyni4g9OTU0K7KsKOuu1p6DuqRIlUvvoR3Z7:Y/9RgFl9bDuqGyvvoRJGRJRRJLRJuOlS
Score

10^/10

wannacry discovery persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2