wannacry

General

Target

01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.zip
Size

190KB
Sample

241027-g6basawarl
MD5

30a5588c5341362c0d673d51baeb959b
SHA1

653b7638b82b5a952d34e3f42e8bc822c78ffac9
SHA256

9e193fc6db98c706b8bf2f93ec6b73cb1170e2d785f9a2502a158874625d2c32
SHA512

403e476df0c536106f16e3759e863e8ff26e417566bfcb5a7e466db6c0f494e1788b1800e9e1ed320bc13b6b0e5e4d6a120c99c01b5f0466a3c906a6a8b300f3
SSDEEP

3072:6DxgIdMsfZDro/tQJOFTMeoRO29vA/H/1qh77pig/5ULnOBUT581IgPbca:61gCnroyJo4elHNQp9eW1IAr

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe
- Size
  
  224KB
- MD5
  
  75031983cb851f3475c460a40797fe62
- SHA1
  
  4ee0238f082123aeb7642ea2e427f57cf4ee954a
- SHA256
  
  01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4
- SHA512
  
  635b72c7fb8d8b3818364a8a239941d4b4ec608f3d87ee966ce6abd599b847f2aee1e895d996391a1802a57afb41127fbc5e87020b5b280aca2066039e94ca36
- SSDEEP
  
  3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efc:+5RwTs/dSXj84mRXPemxdBlPvLzLe
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (51) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2