WannaCry Ransomware Activity

{
  "selection_img": [
    {
      "Image
| endswith": [
        "\\tasksche.exe",
        "\\mssecsvc.exe",
        "\\taskdl.exe",
        "\\taskhsvc.exe",
        "\\taskse.exe",
        "\\111.exe",
        "\\lhdfrgui.exe",
        "\\linuxnew.exe",
        "\\wannacry.exe"
      ]
    },
    {
      "Image
| contains": "WanaDecryptor"
    }
  ],
  "selection_cmd": {
    "CommandLine
| contains": "@Please_Read_Me@.txt"
  },
  "condition": "1 of selection_*"
}

False Positives

• ⚠ Unknown