wannacry | e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919 | Triage

Sharing

General

Target

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919
Size

3.6MB
Sample

221010-e2kbsaagdl
MD5

0e0cdad186b2f9fc46c2b90762ccf69c
SHA1

92771a67bbee538a74a8a54380e4f5c947a34991
SHA256

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919
SHA512

a2bfdff6b0711843c9f1254ee2f29db2ad6475b7adb659e82c190d6204f7bb99c464e02a8f2c12be94e2643c5fb05798f013520658069c4244a1e07d500a1f18
SSDEEP

49152:4naMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:oaPoBhz1aRxcSUDk36SAEdhvxWa9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919
- Size
  
  3.6MB
- MD5
  
  0e0cdad186b2f9fc46c2b90762ccf69c
- SHA1
  
  92771a67bbee538a74a8a54380e4f5c947a34991
- SHA256
  
  e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919
- SHA512
  
  a2bfdff6b0711843c9f1254ee2f29db2ad6475b7adb659e82c190d6204f7bb99c464e02a8f2c12be94e2643c5fb05798f013520658069c4244a1e07d500a1f18
- SSDEEP
  
  49152:4naMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:oaPoBhz1aRxcSUDk36SAEdhvxWa9
Score

10^/10

wannacry ransomware worm discovery
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3274) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

wannacryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm