Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\2.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\trivial-merge.htm
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\000814251_video_01.avi.wannacryv2
- %HOMEPATH%\recent\_copy2_08tn017.lnk.wannacryv2
- %HOMEPATH%\recent\xml_word2003.lnk.wannacryv2
- %HOMEPATH%\recent\xml_word.lnk.wannacryv2
- %HOMEPATH%\recent\xml_excel_wiki.lnk.wannacryv2
- %HOMEPATH%\recent\xml_excel.lnk.wannacryv2
- %HOMEPATH%\recent\wpa_kill_6912.lnk.wannacryv2
- %HOMEPATH%\recent\vm introspection.lnk.wannacryv2
- %HOMEPATH%\recent\user.lnk.wannacryv2
- %HOMEPATH%\recent\прочитайка!!!!!.lnk.wannacryv2
- %HOMEPATH%\recent\serial numbers.lnk.wannacryv2
- %HOMEPATH%\recent\reader.lnk.wannacryv2
- %HOMEPATH%\recent\rabotaetvse.ru.lnk.wannacryv2
- %HOMEPATH%\recent\protect.lnk.wannacryv2
- %HOMEPATH%\recent\pdfsigqformalrep.lnk.wannacryv2
- %HOMEPATH%\recent\local disk (d).lnk.wannacryv2
- %HOMEPATH%\recent\virtual-machiene-introspection.lnk.wannacryv2
- %HOMEPATH%\recent\08tn017.lnk.wannacryv2
- %HOMEPATH%\favorites\desktop.ini.wannacryv2
- <Current directory>\wanna cry v2 decryptor.exe
- C:\Documents\user\locals~1\temp\aut5.tmp
- %APPDATA%\wanna cry v2 decryptor.exe
- C:\Documents\user\locals~1\temp\aut4.tmp
- %HOMEPATH%\my documents\wanna cry v2 decryptor.exe
- C:\Documents\user\locals~1\temp\aut3.tmp
- %HOMEPATH%\desktop\wanna cry v2 decryptor.exe
- %HOMEPATH%\recent\local disk (c).lnk.wannacryv2
- %HOMEPATH%\recent\_copy_08tn017.lnk.wannacryv2
- %HOMEPATH%\favorites\msn.com.url.wannacryv2
- %HOMEPATH%\favorites\links\яндекс.url.wannacryv2
- %HOMEPATH%\favorites\links\почта.url.wannacryv2
- %HOMEPATH%\favorites\links\windows.url.wannacryv2
- %HOMEPATH%\favorites\links\windows media.url.wannacryv2
- %HOMEPATH%\favorites\links\windows marketplace.url.wannacryv2
- %HOMEPATH%\favorites\links\free hotmail.url.wannacryv2
- %HOMEPATH%\favorites\radio station guide.url.wannacryv2
- %HOMEPATH%\favorites\links\customize links.url.wannacryv2
- %HOMEPATH%\recent\license_password123.lnk.wannacryv2
- %HOMEPATH%\recent\license.lnk.wannacryv2
- %HOMEPATH%\recent\joshi04.slides.lnk.wannacryv2
- %HOMEPATH%\desktop\telegram.lnk.wannacryv2
- %HOMEPATH%\my documents\icq_rfrset.exe.wannacryv2
- %HOMEPATH%\my documents\firefox setup stub 40.0.2.exe.wannacryv2
- %HOMEPATH%\my documents\firefox setup 40.0.2.exe.wannacryv2
- %HOMEPATH%\my documents\firefox setup 40.0.2 (1).exe.wannacryv2
- %HOMEPATH%\my documents\desktop.ini.wannacryv2
- %HOMEPATH%\my documents\chromesetup.exe.wannacryv2
- C:\Documents\user\locals~1\temp\aut6.tmp
- %HOMEPATH%\my documents\jre-8u60-windows-i586-iftw.exe.wannacryv2
- %HOMEPATH%\desktop\qip 2012.lnk.wannacryv2
- %HOMEPATH%\desktop\pidgin.lnk.wannacryv2
- %HOMEPATH%\desktop\icq.lnk.wannacryv2
- %HOMEPATH%\desktop\chromesetup.exe.wannacryv2
- %HOMEPATH%\desktop\about.htm.wannacryv2
- %HOMEPATH%\desktop\2.jpg.wannacryv2
- %HOMEPATH%\desktop\2.jpeg.wannacryv2
- %HOMEPATH%\my documents\chromesetup (1).exe.wannacryv2
- C:\Documents\user\locals~1\temp\aut2.tmp
- %HOMEPATH%\my documents\mirc743.exe.wannacryv2
- %HOMEPATH%\my documents\my pictures\desktop.ini.wannacryv2
- %HOMEPATH%\my documents\my music\desktop.ini.wannacryv2
- %HOMEPATH%\recent\fp_12.0.0.77_archive.lnk.wannacryv2
- %HOMEPATH%\recent\fp_11.2.202.481_archive.lnk.wannacryv2
- %HOMEPATH%\recent\desktop.ini.wannacryv2
- %HOMEPATH%\recent\clarify.lnk.wannacryv2
- %HOMEPATH%\recent\clarify (2).lnk.wannacryv2
- %HOMEPATH%\recent\cd drive.lnk.wannacryv2
- %HOMEPATH%\my documents\my music\sample music.lnk.wannacryv2
- %HOMEPATH%\recent\boot.lnk.wannacryv2
- %HOMEPATH%\my documents\jre-8u60-windows-i586-iftw (1).exe.wannacryv2
- %HOMEPATH%\my documents\steamsetup.exe.wannacryv2
- %HOMEPATH%\my documents\qip2012.exe.wannacryv2
- %HOMEPATH%\my documents\qip2005.exe.wannacryv2
- %HOMEPATH%\my documents\pidgin-2.10.11.exe.wannacryv2
- %HOMEPATH%\my documents\pidgin-2.10.11 (1).exe.wannacryv2
- %HOMEPATH%\my documents\my pictures\sample pictures.lnk.wannacryv2
- %HOMEPATH%\recent\22ie2h77.default.lnk.wannacryv2
- C:\Documents\user\locals~1\temp\disk fixer.exe
Deletes the following files
- C:\Documents\user\locals~1\temp\aut2.tmp
- C:\Documents\user\locals~1\temp\aut3.tmp
- C:\Documents\user\locals~1\temp\aut4.tmp
- C:\Documents\user\locals~1\temp\aut5.tmp
- C:\Documents\user\locals~1\temp\aut6.tmp
Changes user data files extensions (Trojan.Encoder).
