Extracted

Extracted

• • Target

    2023-05-30_3205d19329d0e2f61a68954586136918_wannacry

  • Size

    3.6MB

  • MD5

    3205d19329d0e2f61a68954586136918

  • SHA1

    f37cea90c2ad78cfdd907b6236c14e8155752162

  • SHA256

    b4aa73f2b39bfb6d8b255faee7e6e37e0c79f835b11e9fac3eeb6bfa78760038

  • SHA512

    7a2ff8f6127ae9a2fc3c0a30e5b54ea2766145b819dd2282f62b4f5840d5767fb83ef11eb44ea972f84faf13ec4b23f71f83e5f0a6a1bfa4f173db631de96974

  • SSDEEP

    98304:wQqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3Y:wQqPe1Cxcxk3ZAEUadzR8yc4gI

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (3165) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Contacts a large (1525) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2