wannacry

General

Target

MEMZ-virus
Size

216KB
Sample

240405-w1xzxsbe43
MD5

5f6ae81699fb6d3dfd316da8cbb536f9
SHA1

8472c7c601becd085c2ba6a1abb1127510e7788e
SHA256

757d61eb05823ceed3ff17edc0dc09cad9def1d08ff0e8bea24c2e55dc257c54
SHA512

f965f1ea1e29e4a803e7732b9579f14840e95eebc2b61badb45b901a43fc38310635415597532cc4160a90140e705a683ecd86370d557ecbae8832c881235197
SSDEEP

6144:LDuqJEf+eVSgE29xxspm0n1vuz3q9WvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi9:Yf+eVSgE29xxspm0n1vuz3q9WvZJT3CW

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  MEMZ-virus
- Size
  
  216KB
- MD5
  
  5f6ae81699fb6d3dfd316da8cbb536f9
- SHA1
  
  8472c7c601becd085c2ba6a1abb1127510e7788e
- SHA256
  
  757d61eb05823ceed3ff17edc0dc09cad9def1d08ff0e8bea24c2e55dc257c54
- SHA512
  
  f965f1ea1e29e4a803e7732b9579f14840e95eebc2b61badb45b901a43fc38310635415597532cc4160a90140e705a683ecd86370d557ecbae8832c881235197
- SSDEEP
  
  6144:LDuqJEf+eVSgE29xxspm0n1vuz3q9WvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi9:Yf+eVSgE29xxspm0n1vuz3q9WvZJT3CW
Score

10^/10

wannacry discovery persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1