wannacry

General

Target

smb-gab_1g0l.zip
Size

449KB
Sample

240809-sn41xsscjk
MD5

1fccbad0bccaad5cca0e7466f31c08bc
SHA1

5aebb99d052c30ad521df8c3cdb6fd30501cf5b8
SHA256

f7aae45df24c828753e769ef66b7527bbf227a50ea263e3b031e667898e016d4
SHA512

0d1ef6f15c66488153d78113ea0bc319487ee29a55fa3d25ac354db1fad6042c26e368c9755f0f6ee300699f794ab93cf5202d3c4e2e895de99dbbedbf5ccd0e
SSDEEP

12288:3PWBQJzxs8uRuMNwJEDFXcjxkTagpM9Eux27:/gQJz/utPXcjSlpGhxe

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

- Target
  
  smb-gab_1g0l.bin
- Size
  
  540KB
- MD5
  
  7d0c735130149ce53c2b5cca912b39a4
- SHA1
  
  1d15cfb315723c508fd17dcb2621af8a17d885a7
- SHA256
  
  1f01ed57b60951c4fd7de05a5d4b324a9ffff272a34aa2f1d4859e4936d99e26
- SHA512
  
  ad91c86e59f948f21f81bddcddd1b323f38baada91ef09cfc46b8d5b7f3f9f45e3f3c37362415f5f523c92b613f4ce79fbb6dbbc8b3d15849449404c0e780d14
- SSDEEP
  
  12288:sNnX1Bmb5RwBG4mxdB9He9DYfH8V6E63Sulx9DpI0gP4Wc:sX1Bc5RFB9He9DYv8V6E6CuBpI0M4Wc
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2