wannacry

General

Target

.gitignore
Size

13B
Sample

240721-brplzascqc
MD5

8de70a2cb48504f474cccade2cc3d20b
SHA1

7cfe378309941545d80f7d6a20348294e02ed9a4
SHA256

a251b542f8d816aa389009d8e1cb059d35c5553387362a07b030161b076432b3
SHA512

221747e0b98083359980b6ec9659703659a2d78715e6d0fdf089e63487c88811352702c9656128238bda8c378cf6bdb713b683b6cf92257db31b375f83de9bf0

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  .gitignore
- Size
  
  13B
- MD5
  
  8de70a2cb48504f474cccade2cc3d20b
- SHA1
  
  7cfe378309941545d80f7d6a20348294e02ed9a4
- SHA256
  
  a251b542f8d816aa389009d8e1cb059d35c5553387362a07b030161b076432b3
- SHA512
  
  221747e0b98083359980b6ec9659703659a2d78715e6d0fdf089e63487c88811352702c9656128238bda8c378cf6bdb713b683b6cf92257db31b375f83de9bf0
Score

10^/10

wannacry defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan worm
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Sets desktop wallpaper using registry
  ransomware
behavioral1