Extracted

• • Target

    mxbikes.exe

  • Size

    3.6MB

  • MD5

    49ffb1b624e1746698c05aa962353768

  • SHA1

    94f4083ddbfa537e08aa1f0de55a56146a8c6351

  • SHA256

    598959308399a249c33e9249cd7511fa9c0c23df00b56ac1d71a7b9743bab1af

  • SHA512

    8dab9e208003d37993b978a9e2e6cf1c5354c4e3300db97a4d1850227a438af28796b7f902f7c05b9251ea604fbb1557f6bdbb25c4bb4ba43f3dc009e5842862

  • SSDEEP

    49152:eJRTFGeek0zge76irmN0v4Ck1HpDDCwo40mjwrvX6OpePuboh0DW6NnCn0hFToSJ:duupCHlmoSDW6NnC0h68b

  Score

  10^/10

  discoverywannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2