wannacry

General

Target

RetroMation.exe
Size

651KB
Sample

250222-ttajyatndj
MD5

9fac86f8e7907791b3c635437b6551b6
SHA1

624d6d8729f2f4ba40f6d3da7f45eddf324ddd11
SHA256

4a52cd7f2d14d93fc2c029c9e3d7534f76aa55fde6ca117f8a239bd621d37346
SHA512

633ee268345018170097d04d46ceae2508aaad02538ae3ec3880ff253a7d35db2b5921c805a87b1320de30d05b0ade121843b7b9669a12fa3f0b649e4a30f566
SSDEEP

6144:I/7FG9mpcJ/OD8J8GTyoTp2sPFHCO6bqYi4qzhWd73KsgoxL:I/744aOD8lTyoTp2stCJZiBz4dyQ

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  RetroMation.exe
- Size
  
  651KB
- MD5
  
  9fac86f8e7907791b3c635437b6551b6
- SHA1
  
  624d6d8729f2f4ba40f6d3da7f45eddf324ddd11
- SHA256
  
  4a52cd7f2d14d93fc2c029c9e3d7534f76aa55fde6ca117f8a239bd621d37346
- SHA512
  
  633ee268345018170097d04d46ceae2508aaad02538ae3ec3880ff253a7d35db2b5921c805a87b1320de30d05b0ade121843b7b9669a12fa3f0b649e4a30f566
- SSDEEP
  
  6144:I/7FG9mpcJ/OD8J8GTyoTp2sPFHCO6bqYi4qzhWd73KsgoxL:I/744aOD8lTyoTp2stCJZiBz4dyQ
Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1