wannacry

General

Target

RobloxPlayerInstaller (2).exe
Size

4.6MB
Sample

240313-pvbfeada6y
MD5

b090d2f2f22eb863bc1b19c0ce9d24ba
SHA1

92d2469466f72e05bfd1be8665673b46a8523077
SHA256

c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
SHA512

a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312
SSDEEP

98304:J6vseEXOI6YbJ8JP6yabDMTwS8g2ZFmu2BftJJmVYobBb0:UiJ6bP5Mg2HQJWnF0

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  RobloxPlayerInstaller (2).exe
- Size
  
  4.6MB
- MD5
  
  b090d2f2f22eb863bc1b19c0ce9d24ba
- SHA1
  
  92d2469466f72e05bfd1be8665673b46a8523077
- SHA256
  
  c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
- SHA512
  
  a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312
- SSDEEP
  
  98304:J6vseEXOI6YbJ8JP6yabDMTwS8g2ZFmu2BftJJmVYobBb0:UiJ6bP5Mg2HQJWnF0
Score

10^/10

wannacry discovery evasion persistence ransomware trojan worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Modifies file permissions
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1