Overview

overview

10

Static

static

DEADLY.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DEADLY.exe

  • Size

    24MB

  • Sample

    230126-xrtrkseh73

  • MD5

    6d4bb02205c4206a53e2567d9feeb567

  • SHA1

    5abd02eac7b35332067bc67d66dc70484d565703

  • SHA256

    7224da6282de5d67b0e6ee4a29a746ddcfd6fa9dea36ee4b2fad4b39a48d68a1

  • SHA512

    ec4b624ad738ef3421899a4a0a0d5a2b15743c45f6b87abdca77ce8f67a9ce4e6934a888d43dbf441b7ad23a3865a3a8b68a67d332c1d0e61b637b40cf78ac20

  • SSDEEP

    393216:ebDuO/sPrggW5mlXb5K842cuwGyjzT8I3A666Sq6nrS44OUEhe:eGGvy4n2cuW/3VS8DOnc

Score
10/10
wannacrydiscoveryevasionpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Windows\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      DEADLY.exe

    • Size

      24MB

    • MD5

      6d4bb02205c4206a53e2567d9feeb567

    • SHA1

      5abd02eac7b35332067bc67d66dc70484d565703

    • SHA256

      7224da6282de5d67b0e6ee4a29a746ddcfd6fa9dea36ee4b2fad4b39a48d68a1

    • SHA512

      ec4b624ad738ef3421899a4a0a0d5a2b15743c45f6b87abdca77ce8f67a9ce4e6934a888d43dbf441b7ad23a3865a3a8b68a67d332c1d0e61b637b40cf78ac20

    • SSDEEP

      393216:ebDuO/sPrggW5mlXb5K842cuwGyjzT8I3A666Sq6nrS44OUEhe:eGGvy4n2cuW/3VS8DOnc

    Score
    10/10
    wannacrydiscoveryevasionpersistenceransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation

                  Tasks