Extracted

• • Target

    attachment.gif

  • Size

    98KB

  • MD5

    5d5f3766d517c2fdd2c173f6cc055f6a

  • SHA1

    d9e968de7644bc197e3d04d87734c2e2a69458bd

  • SHA256

    94b6429e2354021dd910335067a7779a58e2ebc268046fac3871598a7601610a

  • SHA512

    f7a3ce0654f696c8fe008e96de72b280a0352900f45f446997f0dcd2d4351e14b6113db1a621760a3fc70f67684f9a160b4509c2aa848bc034dec1eb510b13cb

  • SSDEEP

    3072:MXIAMeTi36iThoYIkGXt1jAXPaN1ZuI+4fOZ0:+W0MGXqP4P+uOG

  Score

  10^/10

  wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2