Overview

overview

10

Static

static

3

2023-12-09...ry.exe

windows7-x64

10

2023-12-09...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-12-09_501506dd6c96eaf9d9a949ec66426541_wannacry

  • Size

    3.6MB

  • Sample

    231210-q3x5taeadk

  • MD5

    501506dd6c96eaf9d9a949ec66426541

  • SHA1

    756fa974117f6cb088bc0d23a0177f5d3f8b0a08

  • SHA256

    02b51818960b96e62288a3522cb9306e9a71950cb0f84a5e91285baa6dc5a080

  • SHA512

    66bc6b508cbf71cc50caa971f3968943ac29ed04c0396db389002a48af8c6a3a42cf6a58054d93692e51831cda8cd0c54932f0ca281fcc0945e51e684d30a173

  • SSDEEP

    98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5A3R:yDqPe1Cxcxk3ZAEUadSB

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      2023-12-09_501506dd6c96eaf9d9a949ec66426541_wannacry

    • Size

      3.6MB

    • MD5

      501506dd6c96eaf9d9a949ec66426541

    • SHA1

      756fa974117f6cb088bc0d23a0177f5d3f8b0a08

    • SHA256

      02b51818960b96e62288a3522cb9306e9a71950cb0f84a5e91285baa6dc5a080

    • SHA512

      66bc6b508cbf71cc50caa971f3968943ac29ed04c0396db389002a48af8c6a3a42cf6a58054d93692e51831cda8cd0c54932f0ca281fcc0945e51e684d30a173

    • SSDEEP

      98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5A3R:yDqPe1Cxcxk3ZAEUadSB

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (2852) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Network Service Discovery

2
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks