wannacry

General

Target

hel.txt
Size

406B
Sample

240906-xxybystcpm
MD5

15da365f4f090a3e38d8329e6860ba83
SHA1

093b8444b4d0bb1e91255b5cd9e875738c2ce916
SHA256

2fed09c8225b81f260bc0f3ef29ca802ad881d408a7ea9b81b9fcbf15783c0ac
SHA512

316daa931daeb1c60b970363d1d6269f52ff7c7e829e4c3e9e90321fc97fc0dc8278de53417765b4d3372eb8da1e6bbb33bea9e2f1f7be4b588ba5acd36811b7

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  hel.txt
- Size
  
  406B
- MD5
  
  15da365f4f090a3e38d8329e6860ba83
- SHA1
  
  093b8444b4d0bb1e91255b5cd9e875738c2ce916
- SHA256
  
  2fed09c8225b81f260bc0f3ef29ca802ad881d408a7ea9b81b9fcbf15783c0ac
- SHA512
  
  316daa931daeb1c60b970363d1d6269f52ff7c7e829e4c3e9e90321fc97fc0dc8278de53417765b4d3372eb8da1e6bbb33bea9e2f1f7be4b588ba5acd36811b7
Score

10^/10

wannacry bootkit defense_evasion discovery evasion execution impact persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Modifies file permissions
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1