Extracted

• • Target

    Ransomware.CryptoWall.zip

  • Size

    59KB

  • MD5

    ef0fff38bd2c9dfdb24d73c6861dcb9e

  • SHA1

    f17b98dcdd5a93f0a9ea3961de381ff3898add56

  • SHA256

    8bccc78422858ec95ce2b9b29e53c1ae4aacfd37fdcc35d38e90410ef8cd8c0b

  • SHA512

    04f5299c1905d4f4da18585cf843273aa547c4e4d84b84befff9da749d5690ce378dc7b9dd19d77bd54761ede5f9bf8c388bb7563dffb0045023c580792fcae9

  • SSDEEP

    768:LIa0DdTKY1MaPGlD5cmttnlNndZJjOvkFRxlRS49hF3ZI+ozfbq8GyeYgS3Qb90S:MhgaPaWmf/1jO0RVnPo7OQewjT8Z

  Score

  1^/10
  behavioral1

• • Target

    Ransomware.CryptoWall.exe

  • Size

    132KB

  • MD5

    919034c8efb9678f96b47a20fa6199f2

  • SHA1

    747070c74d0400cffeb28fbea17b64297f14cfbd

  • SHA256

    e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

  • SHA512

    745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

  • SSDEEP

    3072:naRQpzd/99wen3XgWorw8I3h8LkMvqCgQfBUnPy8L6kssU:nJdTwo30ri3h8LkMvqCgQfBUPy8L6ksP

  Score

  10^/10

  cryptolockerwannacrydiscoverypersistenceransomwarespywarestealerworm

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (294) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral2