wannacry | af116c6a6bbda54c5e488e6530829e1d6f61ed0e71aa0b424f0ab42e52f4cd74 | Triage

Sharing

General

Target

3fcb1d7200eda4dcdf2178c9c78e4f5d
Size

3.6MB
Sample

220825-ya2xashhdk
MD5

3fcb1d7200eda4dcdf2178c9c78e4f5d
SHA1

22daa8b47db8c5436be7acc7dda675e724d6c1e5
SHA256

af116c6a6bbda54c5e488e6530829e1d6f61ed0e71aa0b424f0ab42e52f4cd74
SHA512

23f534d3efc849c40aef28ca747904838e506c9ef584f98a28e5c536d79b091b9354434f844facf5471777dc5c4531e32aa4f529a41177fb6a85f27be1df7bc0
SSDEEP

24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYDLAE6fm8f5Qjn0kQm3yJJkzswor:2nAQqMSPbcBVQej/1gLAEHTnQJJzw

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  3fcb1d7200eda4dcdf2178c9c78e4f5d
- Size
  
  3.6MB
- MD5
  
  3fcb1d7200eda4dcdf2178c9c78e4f5d
- SHA1
  
  22daa8b47db8c5436be7acc7dda675e724d6c1e5
- SHA256
  
  af116c6a6bbda54c5e488e6530829e1d6f61ed0e71aa0b424f0ab42e52f4cd74
- SHA512
  
  23f534d3efc849c40aef28ca747904838e506c9ef584f98a28e5c536d79b091b9354434f844facf5471777dc5c4531e32aa4f529a41177fb6a85f27be1df7bc0
- SSDEEP
  
  24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYDLAE6fm8f5Qjn0kQm3yJJkzswor:2nAQqMSPbcBVQej/1gLAEHTnQJJzw
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2109) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (1286) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm