wannacry

General

Target

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c
Size

4.3MB
Sample

220825-ap3kdaeaf9
MD5

4da1f312a214c07143abeeafb695d904
SHA1

b629f072c9241fd2451f1cbca2290197e72a8f5e
SHA256

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c
SHA512

0b3281132890039638bed1bd815261b6f6d6bc8bf63467d6a1cdd41f4de89e1d10b241a273378e5f5a1401ea10c0b2974f44a585c92ba15639d80c0501b258c9
SSDEEP

98304:zcI8HbSxeeqe5hXlpIyS+PiwTNl/iZ102q7O3cOtgP5HYPNtNO8/I04miT4RTMpK:zD28tqeDNPLTmZR4Ou5H8NbOR04g5MpK

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send 0.3 BTC to this bitcoin address: 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) https://www.dropbox.com/s/c1gn29iy8erh1ks/m.rar?dl=1 rar password: wcry123 Run and follow the instructions! �

Targets

- Target
  
  aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c
- Size
  
  4.3MB
- MD5
  
  4da1f312a214c07143abeeafb695d904
- SHA1
  
  b629f072c9241fd2451f1cbca2290197e72a8f5e
- SHA256
  
  aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c
- SHA512
  
  0b3281132890039638bed1bd815261b6f6d6bc8bf63467d6a1cdd41f4de89e1d10b241a273378e5f5a1401ea10c0b2974f44a585c92ba15639d80c0501b258c9
- SSDEEP
  
  98304:zcI8HbSxeeqe5hXlpIyS+PiwTNl/iZ102q7O3cOtgP5HYPNtNO8/I04miT4RTMpK:zD28tqeDNPLTmZR4Ou5H8NbOR04g5MpK
Score

10^/10

wannacry persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1