wannacry

Target

Верена-Вермут-Забранената-жена-Преживяно.pdf
Size

5.5MB
Sample

240127-vyha1sgeg2
MD5

e8e518d9a22374ddcb271650017cf2c4
SHA1

7fe3dedb6df963944fec6ce87a3c5e2b83a37826
SHA256

7d510c591ea3fe3dd0ba019963f2ae41ce6b22fcef13d979f6cfa2920eb87fb9
SHA512

b31059e623ee4ecf10c52fc94b0793cb6b8fbbeeb4a81383c15386965b6ce72dc22863b3a2544229d6b2b8c35554b298b5dc6172e4d3978f2806fcee6de9d609
SSDEEP

98304:cLn/fhzkxlBUKvImbgB2vYH95Wl7CxS9bunt9RzXtFzGkXfJEy5UCtahfS:0/t4lBUKvImbgBkYHKhvszXBEAgS

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  Верена-Вермут-Забранената-жена-Преживяно.pdf
- Size
  
  5.5MB
- MD5
  
  e8e518d9a22374ddcb271650017cf2c4
- SHA1
  
  7fe3dedb6df963944fec6ce87a3c5e2b83a37826
- SHA256
  
  7d510c591ea3fe3dd0ba019963f2ae41ce6b22fcef13d979f6cfa2920eb87fb9
- SHA512
  
  b31059e623ee4ecf10c52fc94b0793cb6b8fbbeeb4a81383c15386965b6ce72dc22863b3a2544229d6b2b8c35554b298b5dc6172e4d3978f2806fcee6de9d609
- SSDEEP
  
  98304:cLn/fhzkxlBUKvImbgB2vYH95Wl7CxS9bunt9RzXtFzGkXfJEy5UCtahfS:0/t4lBUKvImbgBkYHKhvszXBEAgS
Score

10^/10

wannacry discovery persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1