Extracted

• • Target

    Free Software Downloads and Reviews for Windows, Android, Mac, and iOS – CNET Downloadrr.html

  • Size

    827KB

  • MD5

    e7a7046d8aed5ee76856b037c7a6459e

  • SHA1

    de207e6ef6cc6bcfe2b498dee3cea5364826a829

  • SHA256

    9110c6498cd6c64f7035ea0f915d1fa51fce1775c5282587c2e21d5dab1c9bd6

  • SHA512

    16f9f606fb64420d5fa8a3e48798a084b495a07663fa0bce5d1580ace5378afabf1211813abbf901ef70c6bc41fd6e95bdecd2da3cd81ef8984d5d2b116da672

  • SSDEEP

    12288:hhLhDIPdQiaLW9vqXkS3cY9r7QeQIOEvB8SRHrLTX8HLEfxtM1V+DNFZleSBvFFj:hhSPdQiaLW9vqjWq/omTiRw

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerupxworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1