Extracted

• • Target
    360_F_298288984_8i0PB7s9aWPzi1LeuNGGrnjXkmXRpcZn.jpg
  • Size 21KB
  • SHA256 777143ae2f0bcd842a4550efe8e33694565bd9858a41e5db6f1e0748acbdc468
  • MD5 4df5b997fec1a446f392aaa339187a90
  • SHA1 156d630aa77bb0bbadc2e4227e03e0ae3a204cd2
  • SHA512 8976caeb66407ceabb02c5ed7edf78543a6981f799864121be0e8b1f4569592ca76afd762f4ab9b3ccd39a62fb23a0269291643a694433a1fee90a8228f7993c
  • SSDEEP 384:SoCJ7SzDlRC4HY7TOAxf8si7QhyMqoFF1zJ+HT++zlLqHU6PJSA/+oULYrpfkP:S4PlIIc3i7QzFHzJ+H6+zlLMUT5KkP
  • TLSH
    T18EA2BF0EDB8504C4C79E9A3312E7CB8A5732B1B0EBE6420FF35D087B5B18B564E971A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2