wannacry

General

Target

2024-04-19_ae28acab5a5cb7a2730ea8c264ccdf0d_cryptolocker
Size

74KB
Sample

240419-sdfkksfc54
MD5

ae28acab5a5cb7a2730ea8c264ccdf0d
SHA1

3102afce7196cef15cc8aa37809787c55e48eb8b
SHA256

374ab80c3582d9276ec25e4fb660d5be7ebb6808492bd343fa6457a821612be6
SHA512

bae7935e33a7bed8ba58c2049b9b05fbb7a1440327e74f1c9cb18d91542f440ae4d0733a8d1877f95de570fb8c6880b0691b2c4219c1cca82363986c623e8547
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFj:1nK6a+qdOOtEvwDpjF

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

- Target
  
  2024-04-19_ae28acab5a5cb7a2730ea8c264ccdf0d_cryptolocker
- Size
  
  74KB
- MD5
  
  ae28acab5a5cb7a2730ea8c264ccdf0d
- SHA1
  
  3102afce7196cef15cc8aa37809787c55e48eb8b
- SHA256
  
  374ab80c3582d9276ec25e4fb660d5be7ebb6808492bd343fa6457a821612be6
- SHA512
  
  bae7935e33a7bed8ba58c2049b9b05fbb7a1440327e74f1c9cb18d91542f440ae4d0733a8d1877f95de570fb8c6880b0691b2c4219c1cca82363986c623e8547
- SSDEEP
  
  1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFj:1nK6a+qdOOtEvwDpjF
Score

10^/10

upx wannacry bootkit discovery persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2