wannacry

General

Target

Ransomware tool pack.zip
Size

308.1MB
Sample

241202-t8ahgssnay
MD5

27ddde20723c9509baed52cd5a152859
SHA1

f3dac2e94887499ee4c08b4c5fad469b79616634
SHA256

92e603c1a66049a7a665188ecc3c161b916ba8663bc00893281d04997d701f95
SHA512

25e5aa10ed609f217cbfdd67c133f9bb084b2d3928b4a6a34136b668c60ef120313c3a6a04406b71b26bdfc07c65e7de86a3fd1670de82eca403f2855122d273
SSDEEP

6291456:zMVAM35Xw9SyxlbFkMi1YckafrOs+wE9a63HMoOr3oVJzJWlsmyNHV8:YVJXgSyxlbFO1YckMy3pJOCz3T18

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Ransomware tool pack\Ransomware tool pack\ransomware virus\wannacry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  Ransomware tool pack.zip
- Size
  
  308.1MB
- MD5
  
  27ddde20723c9509baed52cd5a152859
- SHA1
  
  f3dac2e94887499ee4c08b4c5fad469b79616634
- SHA256
  
  92e603c1a66049a7a665188ecc3c161b916ba8663bc00893281d04997d701f95
- SHA512
  
  25e5aa10ed609f217cbfdd67c133f9bb084b2d3928b4a6a34136b668c60ef120313c3a6a04406b71b26bdfc07c65e7de86a3fd1670de82eca403f2855122d273
- SSDEEP
  
  6291456:zMVAM35Xw9SyxlbFkMi1YckafrOs+wE9a63HMoOr3oVJzJWlsmyNHV8:YVJXgSyxlbFO1YckMy3pJOCz3T18
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware upx worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2