Extracted

Extracted

• • Target

    2023-05-31_22528c61996a5b124f5514ade9523df7_wannacry

  • Size

    3.6MB

  • MD5

    22528c61996a5b124f5514ade9523df7

  • SHA1

    13cc2d9dc864e9a2a96cf0d13e6289f6970bfec4

  • SHA256

    c1f88e93b7e520be548a497779faa423c46e694c96d90b1fd3ab43f180953af3

  • SHA512

    6a35d36bc4f56aefa81d6a75b92f09d7578d3ff8bf02b44d088620f9408ab6a7696be865dd4265c914f0207c600ea63ab5806f41364dbba02d9d88ef4f23b5dd

  • SSDEEP

    98304:wQqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3K:wQqPe1Cxcxk3ZAEUadzR8yc4g6

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (3290) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Contacts a large (1456) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2