Extracted

• • Target

    LisectAVT_2403002A_223.exe

  • Size

    3.6MB

  • MD5

    f8e7e70079892d9e07f872e4561f5ce6

  • SHA1

    553d0e9f1386bad1ccad99eadc7b7e70bae6d4a5

  • SHA256

    6434bad20d634f234a51fef43cf45be1b023bc19cdf17918f5bfe6e94c885997

  • SHA512

    8846ec45ecfdda6e916d93d640afab621d7a56efa9f171ae223d8e43fd68bdcff075adfeced115062f5e02d142fdcad368b967f1562a1da52f1884e90f740e59

  • SSDEEP

    98304:IlqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3h:IlqPe1Cxcxk3ZAEUadzR8yc4gR

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (3056) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2