wannacry

General

Target

2025-02-13_47a747b8fc6203d124d7561e34844210_wannacry
Size

5.0MB
Sample

250213-3asqvaxpbv
MD5

47a747b8fc6203d124d7561e34844210
SHA1

11ff25ecd585fee1131bf771a132e4ebe5537d2e
SHA256

8bcc0834690b70a9f2e41ad0938d775b5ee01f35bd8fd96fb9c8711e25016cd0
SHA512

de1b5f28ec65b6b56512fce6bafc6f98500486c731e3199b973b9591a249870e24c851a67592ca28ef262108f7c12db590f52faf6be75312e9985da78837227b
SSDEEP

6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V2:GwbLgPluxQhMbaIMu7L5NVErCA4z/

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-13_47a747b8fc6203d124d7561e34844210_wannacry
- Size
  
  5.0MB
- MD5
  
  47a747b8fc6203d124d7561e34844210
- SHA1
  
  11ff25ecd585fee1131bf771a132e4ebe5537d2e
- SHA256
  
  8bcc0834690b70a9f2e41ad0938d775b5ee01f35bd8fd96fb9c8711e25016cd0
- SHA512
  
  de1b5f28ec65b6b56512fce6bafc6f98500486c731e3199b973b9591a249870e24c851a67592ca28ef262108f7c12db590f52faf6be75312e9985da78837227b
- SSDEEP
  
  6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V2:GwbLgPluxQhMbaIMu7L5NVErCA4z/
Score

10^/10

wannacry discovery ransomware worm adware persistence privilege_escalation stealer
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (3239) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2