wannacry

General

Target

RobloxPlayerInstaller.scr
Size

7.3MB
Sample

250201-lplgmswpgz
MD5

027183c8f1be3ad3b30d3c8cf7332988
SHA1

a7de0320e768d2f737c30e77be4ca5043c3dbe55
SHA256

5f02e34dc5d7a478675fef3b4bfa9ed321bf6b6f8d6804aef7b243e360fba2fd
SHA512

66aefb4f2295d66da768ada2849e498145ef0f8d1e2e4c4bb7daa1745b6937742451c2f1eaf3dad35833096179e4b9d123487d744106a709f34c6a7bc8f589ac
SSDEEP

98304:lvvXbqLcfF4SNvJ7JuDjjCD2W8zhFxXTWgjY5z8D7PGPZs44bMHES3yFkwOY:5XbqLc26ijWGhFxXIz8D7PGPT4IhySc

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

- Target
  
  RobloxPlayerInstaller.scr
- Size
  
  7.3MB
- MD5
  
  027183c8f1be3ad3b30d3c8cf7332988
- SHA1
  
  a7de0320e768d2f737c30e77be4ca5043c3dbe55
- SHA256
  
  5f02e34dc5d7a478675fef3b4bfa9ed321bf6b6f8d6804aef7b243e360fba2fd
- SHA512
  
  66aefb4f2295d66da768ada2849e498145ef0f8d1e2e4c4bb7daa1745b6937742451c2f1eaf3dad35833096179e4b9d123487d744106a709f34c6a7bc8f589ac
- SSDEEP
  
  98304:lvvXbqLcfF4SNvJ7JuDjjCD2W8zhFxXTWgjY5z8D7PGPZs44bMHES3yFkwOY:5XbqLc26ijWGhFxXIz8D7PGPT4IhySc
Score

10^/10

wannacry defense_evasion discovery execution impact ransomware trojan worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Downloads MZ/PE file
- Modifies file permissions
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1