wannacry

General

Target

sharlotan54_2023-06-15-01-37-14_1686775034399.mp4
Size

473KB
Sample

240611-xjnklaxdlh
MD5

25c252bc27cf7bc7997211bb9535b121
SHA1

d479ae3764bc55011710e1dacdcf835c3319ea04
SHA256

143e0902549cc52134118e70d9d890ac9279cab6c6239cbe85468ea37ff47956
SHA512

38980abb9f6236aab581bef062ac1a207501a7b12ed089ce2f24ee9c57e3d25bad1586e5302abdd5b9ccd65bccc4a1686646ac6d71a1e94ab080e5cc7361bece
SSDEEP

6144:dMWnHytWrDW2MfyJSluVKd8o+sUVTGiaO1KJivGpK/q5PpMfuvT938:dgOMfOVE+xVT5aJJieLRauy

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  sharlotan54_2023-06-15-01-37-14_1686775034399.mp4
- Size
  
  473KB
- MD5
  
  25c252bc27cf7bc7997211bb9535b121
- SHA1
  
  d479ae3764bc55011710e1dacdcf835c3319ea04
- SHA256
  
  143e0902549cc52134118e70d9d890ac9279cab6c6239cbe85468ea37ff47956
- SHA512
  
  38980abb9f6236aab581bef062ac1a207501a7b12ed089ce2f24ee9c57e3d25bad1586e5302abdd5b9ccd65bccc4a1686646ac6d71a1e94ab080e5cc7361bece
- SSDEEP
  
  6144:dMWnHytWrDW2MfyJSluVKd8o+sUVTGiaO1KJivGpK/q5PpMfuvT938:dgOMfOVE+xVT5aJJieLRauy
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1