wannacry

General

Target

Juan_Jose_Arroyave.pptx
Size

391KB
Sample

240422-14kafsha7z
MD5

1ed8af1936be540d5ebb0eca5467ac4b
SHA1

977994b9053c82f37579963e0e1383cc4095f64e
SHA256

05eb98b16f214cef97d3041a93a801329f76e8e8066df37ef0f3720e5654387e
SHA512

0d96f86882feef2e33caf48125285ed0aa653e7469a0b0775f80d400860f6ce9ab7a5015373ee2c7758151360da2555934391f964807c7fdb0dcf41ff847dc41
SSDEEP

12288:Qarbw6IRkt1T9+41zD/n/r8ge0hJ5hM6RINgyV:QaA6IaH+45/n/r8ge0Y6RyHV

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

- Target
  
  Juan_Jose_Arroyave.pptx
- Size
  
  391KB
- MD5
  
  1ed8af1936be540d5ebb0eca5467ac4b
- SHA1
  
  977994b9053c82f37579963e0e1383cc4095f64e
- SHA256
  
  05eb98b16f214cef97d3041a93a801329f76e8e8066df37ef0f3720e5654387e
- SHA512
  
  0d96f86882feef2e33caf48125285ed0aa653e7469a0b0775f80d400860f6ce9ab7a5015373ee2c7758151360da2555934391f964807c7fdb0dcf41ff847dc41
- SSDEEP
  
  12288:Qarbw6IRkt1T9+41zD/n/r8ge0hJ5hM6RINgyV:QaA6IaH+45/n/r8ge0Y6RyHV
Score

10^/10

wannacry discovery persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1