wannacry

General

Target

Lagtrain.ogg
Size

5.7MB
Sample

241218-zs1mmaslhj
MD5

6e1abcf21c4e7fba9fa449afaaec52f1
SHA1

604e332e0b668cf66e8e3d01ee74c21430f355a8
SHA256

9c1afcc7564ca35fae64eae9e12a309a95d43341c6c344620fd4f7c348d392c0
SHA512

5af2796144396b15a0fa6eb4f15de2a285b03409902cfd34da11d1522546f8c2cecf2e03b22536d4d9e27d686d804510fa7a49736447edb238cd2346ec33685b
SSDEEP

98304:4bE5Q2t4bm2mbZz8BHh0SQQN561MgmvnhulK2o0p2P7x1NqpvSqAcHfW5WSQpK:445Q2tSm2mbZz6h0SQkuSF2tIl1Nqpvs

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  Lagtrain.ogg
- Size
  
  5.7MB
- MD5
  
  6e1abcf21c4e7fba9fa449afaaec52f1
- SHA1
  
  604e332e0b668cf66e8e3d01ee74c21430f355a8
- SHA256
  
  9c1afcc7564ca35fae64eae9e12a309a95d43341c6c344620fd4f7c348d392c0
- SHA512
  
  5af2796144396b15a0fa6eb4f15de2a285b03409902cfd34da11d1522546f8c2cecf2e03b22536d4d9e27d686d804510fa7a49736447edb238cd2346ec33685b
- SSDEEP
  
  98304:4bE5Q2t4bm2mbZz8BHh0SQQN561MgmvnhulK2o0p2P7x1NqpvSqAcHfW5WSQpK:445Q2tSm2mbZz6h0SQkuSF2tIl1Nqpvs
Score

10^/10

wannacry defense_evasion discovery persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1