wannacry

General

Target

Bez tytułu.png
Size

210B
Sample

240426-p96j4acc27
MD5

96406703da080780229fa319f2448994
SHA1

787b6fe4be3e95e0592f9deddaccdb2a5eb4ce41
SHA256

9ae0449c3a39d09fd963fce70aae5bc6f5ff2f08bfa902d306b40f33bdaa3cef
SHA512

c136373ed8c0683dc69e6b56c6bf7a2166b86621ac74de0bdca59bfaa0f1c65d7e3b451be3c981f37dcd130ce053d14137fe059d0a22b2834580ab6493b1e325

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  Bez tytułu.png
- Size
  
  210B
- MD5
  
  96406703da080780229fa319f2448994
- SHA1
  
  787b6fe4be3e95e0592f9deddaccdb2a5eb4ce41
- SHA256
  
  9ae0449c3a39d09fd963fce70aae5bc6f5ff2f08bfa902d306b40f33bdaa3cef
- SHA512
  
  c136373ed8c0683dc69e6b56c6bf7a2166b86621ac74de0bdca59bfaa0f1c65d7e3b451be3c981f37dcd130ce053d14137fe059d0a22b2834580ab6493b1e325
Score

10^/10

wannacry discovery evasion ransomware spyware stealer trojan worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Downloads MZ/PE file
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1