wannacry | f73ef92a463852a6ab8e141805a52a85dba0ce251d8e1a2b3dc27412c25e4806 | Triage

Sharing

General

Target

56676839d1325a3d51d478f79d292b32_JaffaCakes118
Size

5.0MB
Sample

240518-x7zyjabf4s
MD5

56676839d1325a3d51d478f79d292b32
SHA1

c8b24b041661f8a1f4b16691d8973961ab4a7fd4
SHA256

f73ef92a463852a6ab8e141805a52a85dba0ce251d8e1a2b3dc27412c25e4806
SHA512

880b4e1498285f6da929dc8001665e5e72ba3e6c16fc57d819429ac595fb4253789d38f5c457a7b5d3c374f3dedbd3aaaf4621f5a8e3e25279d46c571007e5eb
SSDEEP

12288:n6bLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+Dx:6bLgddQhfdmMSirYbcMNgef0

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  56676839d1325a3d51d478f79d292b32_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  56676839d1325a3d51d478f79d292b32
- SHA1
  
  c8b24b041661f8a1f4b16691d8973961ab4a7fd4
- SHA256
  
  f73ef92a463852a6ab8e141805a52a85dba0ce251d8e1a2b3dc27412c25e4806
- SHA512
  
  880b4e1498285f6da929dc8001665e5e72ba3e6c16fc57d819429ac595fb4253789d38f5c457a7b5d3c374f3dedbd3aaaf4621f5a8e3e25279d46c571007e5eb
- SSDEEP
  
  12288:n6bLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+Dx:6bLgddQhfdmMSirYbcMNgef0
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3159) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm