wannacry

General

Target

2025-02-16_a4cb43a162a1fe5efa33883677fccfb3_wannacry
Size

5.0MB
Sample

250216-rtpbzszmfj
MD5

a4cb43a162a1fe5efa33883677fccfb3
SHA1

ae81bb6e919219dc671c75641a26067ddde38cb0
SHA256

e1936ea041482c937eb963d3e355025993c52e1b0110884a043271aabbe2bb65
SHA512

32328165bd900e824c4668c64f7c84a8584349692c4ab2774e0070fae7e68f48d52aa6dcce65ec8e1a1e103feb27a05ffb790b13c1a880fb9ba4d322862d1d27
SSDEEP

24576:XbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL:XnAQqMSPbcBVQej/1IN

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-16_a4cb43a162a1fe5efa33883677fccfb3_wannacry
- Size
  
  5.0MB
- MD5
  
  a4cb43a162a1fe5efa33883677fccfb3
- SHA1
  
  ae81bb6e919219dc671c75641a26067ddde38cb0
- SHA256
  
  e1936ea041482c937eb963d3e355025993c52e1b0110884a043271aabbe2bb65
- SHA512
  
  32328165bd900e824c4668c64f7c84a8584349692c4ab2774e0070fae7e68f48d52aa6dcce65ec8e1a1e103feb27a05ffb790b13c1a880fb9ba4d322862d1d27
- SSDEEP
  
  24576:XbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL:XnAQqMSPbcBVQej/1IN
Score

10^/10

wannacry discovery ransomware worm adware persistence privilege_escalation stealer
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (3211) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2