wannacry

General

Target

disney__valid_combos.txt
Size

18KB
Sample

220826-3qx1habbdk
MD5

f52af7653650c4abb52b3a83eda168b0
SHA1

ba3d5f7aef5a5e5aa456a994f3bfd8d5604a030e
SHA256

65f8627ffed18384566a5489b726d8725a7279e4b62bc3ad15afc28455b3327e
SHA512

d8f64d533fb2fc2ba4937d6db981c5adffd9ef13aee2241c1cdbfb2729c73ae9288c820cf5789c0c2fa57871b1369237a5bcb42f9bc36517ad227f8a7890c199
SSDEEP

384:XAWO6NBYbG2jtjDC91SPDJLTAAc2BQanwtROezuqApI:wWOvbjqSL10p2Pw7OePApI

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  disney__valid_combos.txt
- Size
  
  18KB
- MD5
  
  f52af7653650c4abb52b3a83eda168b0
- SHA1
  
  ba3d5f7aef5a5e5aa456a994f3bfd8d5604a030e
- SHA256
  
  65f8627ffed18384566a5489b726d8725a7279e4b62bc3ad15afc28455b3327e
- SHA512
  
  d8f64d533fb2fc2ba4937d6db981c5adffd9ef13aee2241c1cdbfb2729c73ae9288c820cf5789c0c2fa57871b1369237a5bcb42f9bc36517ad227f8a7890c199
- SSDEEP
  
  384:XAWO6NBYbG2jtjDC91SPDJLTAAc2BQanwtROezuqApI:wWOvbjqSL10p2Pw7OePApI
Score

10^/10

wannacry discovery evasion persistence ransomware spyware stealer trojan upx worm
- Suspicious use of NtCreateProcessExOtherParentProcess
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1