wannacry

General

Target

The Stanley Parable Ultra Deluxe.exe
Size

635KB
Sample

241012-xvfdcswgmf
MD5

8f35a1321df52b17b58cefc3c65a7eb8
SHA1

e0b6c2acc51151b41931112c61f1fb9b0cf23b17
SHA256

bd3a1f9763990b580f5f9073e3e23f7dff6369d79c24fef32c9164fadb998374
SHA512

0544c578b2d1737e0125ddb1633026eb5b710c4273d232a6aadca870c8ce9cedf724c2a6d3c1f24d2dcd53e3e910dcd7058753ff775d129cfeeb36482605711f
SSDEEP

12288:Q7qTU7nJYOeAkvS3N88DOt6pD8Flrn7VCufAmPCRJ7dad85Qng3V2DGz//dwH+I9:Gq4JYOeAka3N88qBrn7BfZPwJ7dad85M

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  The Stanley Parable Ultra Deluxe.exe
- Size
  
  635KB
- MD5
  
  8f35a1321df52b17b58cefc3c65a7eb8
- SHA1
  
  e0b6c2acc51151b41931112c61f1fb9b0cf23b17
- SHA256
  
  bd3a1f9763990b580f5f9073e3e23f7dff6369d79c24fef32c9164fadb998374
- SHA512
  
  0544c578b2d1737e0125ddb1633026eb5b710c4273d232a6aadca870c8ce9cedf724c2a6d3c1f24d2dcd53e3e910dcd7058753ff775d129cfeeb36482605711f
- SSDEEP
  
  12288:Q7qTU7nJYOeAkvS3N88DOt6pD8Flrn7VCufAmPCRJ7dad85Qng3V2DGz//dwH+I9:Gq4JYOeAka3N88qBrn7BfZPwJ7dad85M
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1