wannacry

General

Target

code.ps1
Size

5B
Sample

240811-s931rawdkn
MD5

1cbfb724ceee46cd879df7c7cfbe7dca
SHA1

4f9cac8dbc4c67a388b8379dcc126c90c7c5e72a
SHA256

14ebe56a5008e7c251101e9e1fdbe281ab0a82bd6fa00a5cef746b9ee0dd31d1
SHA512

e78a5f8359e1bd6c7a33b79c46d26cecdea9a7171644fed23d4ee26730897fc94c5a2493728424ebdc87a1382e83aea7bab5dc12ab851cea930e031e7205df71

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCrypt0r (2)\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  code.ps1
- Size
  
  5B
- MD5
  
  1cbfb724ceee46cd879df7c7cfbe7dca
- SHA1
  
  4f9cac8dbc4c67a388b8379dcc126c90c7c5e72a
- SHA256
  
  14ebe56a5008e7c251101e9e1fdbe281ab0a82bd6fa00a5cef746b9ee0dd31d1
- SHA512
  
  e78a5f8359e1bd6c7a33b79c46d26cecdea9a7171644fed23d4ee26730897fc94c5a2493728424ebdc87a1382e83aea7bab5dc12ab851cea930e031e7205df71
Score

10^/10

discovery execution wannacry defense_evasion evasion persistence ransomware trojan worm
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Disables RegEdit via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Blocklisted process makes network request
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2