wannacry

Target

Screenshot 2024-08-06 212650.png
Size

302KB
Sample

240811-wf7cvszgmp
MD5

8215cf98ee78db9c15eb03c1d565f6f9
SHA1

03020983659e6d6c61631de0bfdec9a965ec5155
SHA256

ea717e5576dbd3052c3429470ad4f3bc9bae374d4b9cc7d1c0e68055ec810543
SHA512

8e16cdb25bd785bf11608fb983125f71394da0091fa9769ee8504194d0626fca1b66e08245ba6d52af1e498bc16635fcdaedf1dd6b4a77cf9a53d4cd5278a28e
SSDEEP

6144:Rl53DXhOKICpEkz40IFGtwyYCzGpvgrUz9iYdwYIsQ1IxxeTMuG:RlxXgKI2xzdqG1ZTrURnuRsdxxe8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  Screenshot 2024-08-06 212650.png
- Size
  
  302KB
- MD5
  
  8215cf98ee78db9c15eb03c1d565f6f9
- SHA1
  
  03020983659e6d6c61631de0bfdec9a965ec5155
- SHA256
  
  ea717e5576dbd3052c3429470ad4f3bc9bae374d4b9cc7d1c0e68055ec810543
- SHA512
  
  8e16cdb25bd785bf11608fb983125f71394da0091fa9769ee8504194d0626fca1b66e08245ba6d52af1e498bc16635fcdaedf1dd6b4a77cf9a53d4cd5278a28e
- SSDEEP
  
  6144:Rl53DXhOKICpEkz40IFGtwyYCzGpvgrUz9iYdwYIsQ1IxxeTMuG:RlxXgKI2xzdqG1ZTrURnuRsdxxe8
Score

10^/10

wannacry defense_evasion discovery evasion execution impact motw persistence phishing ransomware spyware stealer upx worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1