Extracted

• • Target

    wncry_sample1.exe

  • Size

    3.6MB

  • MD5

    db349b97c37d22f5ea1d1841e3c89eb4

  • SHA1

    e889544aff85ffaf8b0d0da705105dee7c97fe26

  • SHA256

    24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

  • SHA512

    d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38

  • SSDEEP

    98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (3163) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1