Extracted

• • Target

    New Text Document.txt

  • Size

    99B

  • MD5

    04b5c4594fd620c8cde778458b8d3e5d

  • SHA1

    7b3b5293af33a51de1c0ee5f443654ffe6e8bf25

  • SHA256

    633b8266c1c978530726242146a511bc71723fee2cfb4275a8485519a16d2a38

  • SHA512

    ce64dd08f96fc233861867fb4b245740341e38714eb825d2e3a5d807a7e8eaa57460318be3c6db01eb794c48c03e54cebbbcc6cdd11db9527985edc900fd4df8

  Score

  10^/10

  wannacrybootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1