Extracted

• • Target

    9c4d04b14d6aa50e54406dd3d1e45d2799db0e41bc96691fd176970cca8e7aed

  • Size

    3.6MB

  • MD5

    db6cdd64029759967f643ece4d4fe0b3

  • SHA1

    eea0338c03e9a0d9ab2da2a1f937df0da5049faa

  • SHA256

    9c4d04b14d6aa50e54406dd3d1e45d2799db0e41bc96691fd176970cca8e7aed

  • SHA512

    d4b36fa08d30933c5f2f7b77fe49db638dee5fd1750b9df84eb595fac92f45a3a322c3ed5dce9c587c8befcfadf0135bf37924184b53b1fac2048d8e66f9cea3

  • SSDEEP

    98304:wDqPoBhz1aRxcSUD+xWa9P593R8yAVp2g3:wDqPe1CxcxxadzR8yc4g

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (2675) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects command variations typically used by ransomware

  • Drops startup file

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2