wannacry

General

Target

download.jfif
Size

6KB
Sample

240425-ysff1sea6w
MD5

fa39cb8e00137d0e2b21293a4b16e4ea
SHA1

7a9c82d998af90d04717ee9150f383b677cf3c22
SHA256

bc662f21995d6982cf7655a1c23774b131a87c903d5efcdcea07978d1ad86061
SHA512

c35e293873253403df0566f2c6bccfb488190b844e993c73a70ae914a65eb21086a51520bdaf37cb13370864605291e6ed93b97763b997535a00a0596aaa9b65
SSDEEP

192:kfqKJSYkSuqaFNg/N3sJOBZPYyH1CpLHMO:GdVca/1nZr1CpL

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  download.jfif
- Size
  
  6KB
- MD5
  
  fa39cb8e00137d0e2b21293a4b16e4ea
- SHA1
  
  7a9c82d998af90d04717ee9150f383b677cf3c22
- SHA256
  
  bc662f21995d6982cf7655a1c23774b131a87c903d5efcdcea07978d1ad86061
- SHA512
  
  c35e293873253403df0566f2c6bccfb488190b844e993c73a70ae914a65eb21086a51520bdaf37cb13370864605291e6ed93b97763b997535a00a0596aaa9b65
- SSDEEP
  
  192:kfqKJSYkSuqaFNg/N3sJOBZPYyH1CpLHMO:GdVca/1nZr1CpL
Score

10^/10

wannacry bootkit discovery persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1