Extracted

• • Target

    2025-02-07_a17fe664009d09499b6931cf2e0f8435_neshta_wannacry

  • Size

    264KB

  • MD5

    a17fe664009d09499b6931cf2e0f8435

  • SHA1

    0dada95eb81bb92961093e1871124b5ee3d924f3

  • SHA256

    52e6033b88774fb82f111442886751a107a636d9e0c8b392aee4e19340dc656c

  • SHA512

    268f4f841e18b90b107a64c263b71a6cad4234c4f36258efee638f1d61005d7d75c1c1d9b752e19e2a6a456a6ad003419633f9b1fc1538323d975ba4e1877e22

  • SSDEEP

    3072:sr85CcTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efcx59femWRJ:k9cTs/dSXj84mRXPemxdBlPvLzLek5RJ

  Score

  10^/10

  neshtawannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2