wannacry | e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec | Triage

Sharing

General

Target

e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec
Size

5.0MB
Sample

221011-ta886acea3
MD5

b583e353ce412edcb4128c251901db5e
SHA1

482a398c3e8cd2e58f56a5830573b7022456c4d6
SHA256

e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec
SHA512

57a1d8582495933d1914ef65bd907ec9fbb1680b212dca0197b5fd0c6aae094ddb350e4a918bfd2e5731ed18f1de7e7bbc4b7d47333c1d662bc80bd4d97a64de
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec
- Size
  
  5.0MB
- MD5
  
  b583e353ce412edcb4128c251901db5e
- SHA1
  
  482a398c3e8cd2e58f56a5830573b7022456c4d6
- SHA256
  
  e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec
- SHA512
  
  57a1d8582495933d1914ef65bd907ec9fbb1680b212dca0197b5fd0c6aae094ddb350e4a918bfd2e5731ed18f1de7e7bbc4b7d47333c1d662bc80bd4d97a64de
- SSDEEP
  
  98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (1611) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (990) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm