Overview

overview

10

Static

static

3

WannaCry.exe

windows7-x64

10

WannaCry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WannaCry.exe

  • Size

    623KB

  • Sample

    240722-zbapwawhlc

  • MD5

    eea571229a25bc2f5b59dce07c361cb2

  • SHA1

    b341437a1f94d645e5628d8491f068de1a049fb9

  • SHA256

    b0e67944726a2d7a14c9ce5fbfa1914b85666d547cc09118b278e89aeb5307cd

  • SHA512

    1b52740a0fbbb26cd8ad94167b443a81761ba8d48ae9b2931c924a2dcacb3de1727faf12858714712e863cd8d4a6412780ee466e45765565e707422ace583fca

  • SSDEEP

    12288:JzNGgFeDQ8sYnJl6+CIxNbMV6DqJ598Fu8l3hIX61Ho7:TGKUQ8sYJlFtMV6DqJ4u8lQ6S7

Score
10/10
wannacryransomwareworm

Malware Config

Targets

    • Target

      WannaCry.exe

    • Size

      623KB

    • MD5

      eea571229a25bc2f5b59dce07c361cb2

    • SHA1

      b341437a1f94d645e5628d8491f068de1a049fb9

    • SHA256

      b0e67944726a2d7a14c9ce5fbfa1914b85666d547cc09118b278e89aeb5307cd

    • SHA512

      1b52740a0fbbb26cd8ad94167b443a81761ba8d48ae9b2931c924a2dcacb3de1727faf12858714712e863cd8d4a6412780ee466e45765565e707422ace583fca

    • SSDEEP

      12288:JzNGgFeDQ8sYnJl6+CIxNbMV6DqJ598Fu8l3hIX61Ho7:TGKUQ8sYJlFtMV6DqJ4u8lQ6S7

    Score
    10/10
    wannacryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks