Extracted

• • Target

    360_F_584487318_mNIpcoPLHY5N2Rl5nzAzSSBhUgQDby6U.jpg

  • Size

    9KB

  • MD5

    1d5c76d5116d462f48232ce188bbbe80

  • SHA1

    091a07ff008da4a633e6eabb20ba82fda8efd8ac

  • SHA256

    bfda7dfb8bcd912fb01efaca481727d943d26631816cd31935308502a1ecb438

  • SHA512

    660709921605b07a63809ff8191bbe75a1acfc5b697fb2399f17bf84653c790a44c0f50cdd58acade8ca2308f5494f9673d382ba2d71c843b6999c27e3474c21

  • SSDEEP

    192:S8CJ1IIsyrtU1ff2ZrexClfnnoH52KrsX8mu8w97OF:S8CJ1bBZ8Ia22wGOF

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1