wannacry

General

Target

2025-02-12_89687d9f436b93af3d6253daf136b883_wannacry
Size

5.0MB
Sample

250212-zfcp2ayjgv
MD5

89687d9f436b93af3d6253daf136b883
SHA1

a17ad5acad8f0109bf796a84dde8025318e3e097
SHA256

9eb29454d55b46b29c832b3f9f174e2674b423f48a531b525f0895547fcc8e81
SHA512

38716e0b135bfb6992e7adcc41644d8801baa5c05dee58423153e372c78a461dc02f22e7eb051f36c98fd47780da1aaad43e4cdbd152681e991dc7571fe75761
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAEaEau3R8yAH1plAG:yDqPoBhz1aRxcSUDk36SAX3R8yAVp2G

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-12_89687d9f436b93af3d6253daf136b883_wannacry
- Size
  
  5.0MB
- MD5
  
  89687d9f436b93af3d6253daf136b883
- SHA1
  
  a17ad5acad8f0109bf796a84dde8025318e3e097
- SHA256
  
  9eb29454d55b46b29c832b3f9f174e2674b423f48a531b525f0895547fcc8e81
- SHA512
  
  38716e0b135bfb6992e7adcc41644d8801baa5c05dee58423153e372c78a461dc02f22e7eb051f36c98fd47780da1aaad43e4cdbd152681e991dc7571fe75761
- SSDEEP
  
  49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAEaEau3R8yAH1plAG:yDqPoBhz1aRxcSUDk36SAX3R8yAVp2G
Score

10^/10

wannacry discovery ransomware worm adware persistence privilege_escalation stealer
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2754) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2