wannacry

General

Target

screenshot_2024-06-19_10.02.29.png
Size

827KB
Sample

240620-mvdvestarg
MD5

509996dcae4547fb060c16bd2b7f715e
SHA1

88d7127771cd20ce660c6176073ee1e8da31d6f4
SHA256

ff63ffeb34d04a3415fbcacc4b2d7537132581f6c615736ae2b22651dee16d54
SHA512

96440d3d6dd7223c2aa3fb1767d66842b53176f7a394be0202f90dd97ac283ee6a4b2ae37871ad8c94bdcca442a4e529e3d30fc905b1aa9abd0bc75370353c83
SSDEEP

12288:XUMh5epKK7DmszbsvHv86RMOKuNxutB3czOL4ZgR3OogMY+0ZVgW3Par:kMjUKMSCbAkGMOzu3szOsGQBrZVgiU

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  screenshot_2024-06-19_10.02.29.png
- Size
  
  827KB
- MD5
  
  509996dcae4547fb060c16bd2b7f715e
- SHA1
  
  88d7127771cd20ce660c6176073ee1e8da31d6f4
- SHA256
  
  ff63ffeb34d04a3415fbcacc4b2d7537132581f6c615736ae2b22651dee16d54
- SHA512
  
  96440d3d6dd7223c2aa3fb1767d66842b53176f7a394be0202f90dd97ac283ee6a4b2ae37871ad8c94bdcca442a4e529e3d30fc905b1aa9abd0bc75370353c83
- SSDEEP
  
  12288:XUMh5epKK7DmszbsvHv86RMOKuNxutB3czOL4ZgR3OogMY+0ZVgW3Par:kMjUKMSCbAkGMOzu3szOsGQBrZVgiU
Score

10^/10

wannacry defense_evasion discovery persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1