Extracted

• • Target

    23AD77A2BE48A81E4460C894C41A35DB18308A8F85EB841F5BF7AE99265F7310.exe

  • Size

    4.4MB

  • MD5

    afbe6bba36be6ad384e6feccab258960

  • SHA1

    45c076d83c648f195444799aa2eacaf7dde7392a

  • SHA256

    23ad77a2be48a81e4460c894c41a35db18308a8f85eb841f5bf7ae99265f7310

  • SHA512

    420449e730f3e9ccf2d2680ef3f51c7e6d8c78a1dd5de8ee23d2726b1aec011a861bae97644e404bf1fea4944a06fe4d14f39a870ce5a9aa7cd3f916d9f55f50

  • SSDEEP

    98304:GJ4izQvct0rXAAlWmUX5vLxwvfYSU3YD6Si4ftjZWIVTpj1JEOux5uA3mm:GJ/zQvcYAAXUlxcfYRYDZi46IJ3JEO4B

  Score

  10^/10

  wannacrybootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1