Extracted

• • Target
    .gitignore
  • Size 13B
  • SHA256 a251b542f8d816aa389009d8e1cb059d35c5553387362a07b030161b076432b3
  • MD5 8de70a2cb48504f474cccade2cc3d20b
  • SHA1 7cfe378309941545d80f7d6a20348294e02ed9a4
  • SHA512 221747e0b98083359980b6ec9659703659a2d78715e6d0fdf089e63487c88811352702c9656128238bda8c378cf6bdb713b683b6cf92257db31b375f83de9bf0
  • MD5 SHA1 SHA512

  Score

  10^/10

  wannacrydefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojanworm

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1