Extracted

• • Target

    Ransomware

  • Size

    328KB

  • MD5

    6d788eaf3cc1031554c469c98e257afd

  • SHA1

    2aa8933c6bbb645a6172aeeda75192d53ff9a7b6

  • SHA256

    7578c912b272866d3711da823b1292abe68dd63c8f4223f6116acf03f0062dd6

  • SHA512

    e035cfba64abef6646b922b7370381431b64fa91f89a4dc97c2400284f64e9bac2fccc5eb2c32d999e013b383005f20fce7de33b351f5274e382eca72a7c45ad

  • SSDEEP

    6144:s+oj52n9dH5M2vkm0aOCl3pId9RV9OvZJT3CqbMrhryf65NRPaCieMjAkvCJv1Vm:doj52n9dH5M2vkm0aOCl3pId9RV9OvZx

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies RDP port number used by Windows

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2