Extracted

• • Target
    BuilderSans-Regular.otf
  • Size 75KB
  • SHA256 40a248a2229bdd7f0c8f924ef8c94356437d903ac58cf69a06217b9382e88af4
  • MD5 3bad043047220d1c3b2b10e8b65eae9c
  • SHA1 6562136d8165b67ec0f115f70fb9c89595f19915
  • SHA512 f4b0f0eafc9a268b200602247341bfa306a9f24d5305a290343d5cae14d8b868ff2ccaf1a5b2577e66da1952d73b6662440d8ed2f7e9d51836ad9297249f47ec
  • SSDEEP 1536:RDFbM77DVCYso6MiOT9STthp3B1Yic+gw8Wc:fb07DPXAZ1dgwi
  • TLSH
    T100737C1873A5E70DCFD60E34EEB1C3303326B8ADEF1E4217B390665D6C894959A293D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacrypersistenceprivilege_escalationransomwareworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2