Extracted

• • Target

    Main.exe

  • Size

    7.5MB

  • MD5

    3eb46bea293af2205928a34ddb51b8ec

  • SHA1

    7d63680f3d927990eac32daa58d2bfabb1aacb7e

  • SHA256

    6bfc6829a6c86f6ba652b97df5a9772e5d4c3f08a011f0553f229a2e7467f500

  • SHA512

    89a5d7d2e066c7b46827272720a3f5cbe20a9fbee0cf6ee0780c1f09594e6a3b6f8b805b2411381e142321dca12170d51939d4a3b490b46a7ebd940c8bfb1a15

  • SSDEEP

    196608:SgjXSqrf6UkWhJxe6YsdQL/neQ+gKeC3bc1I05O:ljFrfiWxtYsdQL/ejLe5

  Score

  10^/10

  wannacrybootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2