wannacry

General

Target

DEADLY.exe
Size

24.2MB
Sample

230126-xrtrkseh73
MD5

6d4bb02205c4206a53e2567d9feeb567
SHA1

5abd02eac7b35332067bc67d66dc70484d565703
SHA256

7224da6282de5d67b0e6ee4a29a746ddcfd6fa9dea36ee4b2fad4b39a48d68a1
SHA512

ec4b624ad738ef3421899a4a0a0d5a2b15743c45f6b87abdca77ce8f67a9ce4e6934a888d43dbf441b7ad23a3865a3a8b68a67d332c1d0e61b637b40cf78ac20
SSDEEP

393216:ebDuO/sPrggW5mlXb5K842cuwGyjzT8I3A666Sq6nrS44OUEhe:eGGvy4n2cuW/3VS8DOnc

Score

10^/10

Malware Config

Extracted

Path

C:\Windows\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  DEADLY.exe
- Size
  
  24.2MB
- MD5
  
  6d4bb02205c4206a53e2567d9feeb567
- SHA1
  
  5abd02eac7b35332067bc67d66dc70484d565703
- SHA256
  
  7224da6282de5d67b0e6ee4a29a746ddcfd6fa9dea36ee4b2fad4b39a48d68a1
- SHA512
  
  ec4b624ad738ef3421899a4a0a0d5a2b15743c45f6b87abdca77ce8f67a9ce4e6934a888d43dbf441b7ad23a3865a3a8b68a67d332c1d0e61b637b40cf78ac20
- SSDEEP
  
  393216:ebDuO/sPrggW5mlXb5K842cuwGyjzT8I3A666Sq6nrS44OUEhe:eGGvy4n2cuW/3VS8DOnc
Score

10^/10

wannacry discovery evasion persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1