Ransom.Win32.WANNACASH.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
esetsucks = go

Dropping Routine

This Ransomware drops the following files:

• %User Temp%\Public.key (contains Lockbox public key)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware displays the following message boxes:

It does the following:

• It encrypts files with the following strings:
  • *.doc
  • *.docx
  • *.xls
  • *.xlsx
  • *.xlst
  • *.ppt
  • *.pptx
  • *.accdb
  • *.db
  • *.pub
  • *.epub
  • *.pps
  • *.ppsm
  • *.pot
  • *.pages
  • *.odf
  • *.odt
  • *.ods
  • *.pdf
  • *.djvu
  • *.html
  • *.rtf
  • *.txt
  • *.dat
  • *.1Cv8ddb.1cl
  • .1CD
  • *.cf
  • *.dt
  • *.efd
  • *.jpg
  • *.png
  • *.mp4
  • *.mov
  • *.avi
  • *.mpeg
  • *.flv
  • *.gif
  • *.bmp
  • *.3gp
  • *.zip
  • *.rar
  • *.7z
  • *.gzip
  • *.gz
  • *.tib
  • *.bak
  • *.iso
  • *.cpp
  • *.h
  • *.pas
  • *.dpr
  • *.dproj
  • *.py
  • *.JS
  • *.css
  • *.php
  • *.asm
  • *.jar
  • *.apk
  • *.xml
  • Cookies*
  • History*
  • LoginData*
  • Favicons*
  • WebData*
  • *.default
  • dafault*
  • *.psd
  • *.psb
  • *.AEPX
  • *.PRPROJ
  • *.SWF
  • *.veg
  • *.ai
  • *.indd
  • *.AEP
  • *.CHPROJ
  • *.DXF

Ransomware Routine

This Ransomware renames encrypted files using the following names:

• Файл зашифрован [{Encrypted file filename}].wannacash .zip

It drops the following file(s) as ransom note:

• %Desktop%\как расшифровать файлы.txt
• %User Profile%\Documents\как расшифровать файлы.txt
• %User Profile%\Downloads\как расшифровать файлы.txt
• %User Temp%\как расшифровать файлы.txt

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It leaves text files that serve as ransom notes containing the following text: