Extracted

• • Target
    sample
  • Size 15KB
  • SHA256 de804a3edfe3326cc0af190007f77cf6a4fd4dbddec0d7f60aac6d9ce57c32cb
  • MD5 9f8c29bb7d9c814ddfbb37968e0d69bf
  • SHA1 e3dc535a2e5b6432e9bca15fee41ddf541c13446
  • SHA512 ac2c53c01bbdfdca07db91016741f67f21fae7082162d1ff44c4e3706ebd6c095394ec3f418511068af21b4075cf3722b0d435cdb067e1edc130b14bd513e54e
  • SSDEEP 384:umj9HlAALRcomwFfNmBSZv5HvvQ1TCuzMEMhHPIKlkT2zp59FqJPku7:dSu2VDkC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  wannacrybootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojanworm

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    evasion

  • Downloads MZ/PE file

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2