Extracted

• • Target

    SecuriteInfo.com.Trojan.Siggen18.23618.24708.4475.exe

  • Size

    316KB

  • MD5

    b9b3965d1b218c63cd317ac33edcb942

  • SHA1

    02408bb6dc1f3605a7d3f9bad687a858ec147896

  • SHA256

    5d26835be2cf4f08f2beeff301c06d05035d0a9ec3afacc71dff22813595c0b9

  • SHA512

    18096b1167561c6da5bfcc05e40f7661e21f43521eb47da9520d2744c8a1806d7187894ce0ae8e0a9e97904b345daae09897d80e8754a63c9aa1d6514feaf98e

  • SSDEEP

    6144:xHQFwJYDzVc1aWLn0IU4eFTE3Ijr2Cq6j7+qmOq:Z6wWcYWL0IUzNGqJq

  Score

  10^/10

  wannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2