wannacry | 6da34f82d5170e579f967053bc1ecfd27d2777b59ac25807d8dd5148c28748fb | Triage

Sharing

General

Target

58dc734f0486efb9ff6b6b6066e114e0_JaffaCakes118
Size

5.0MB
Sample

240519-glfd1add45
MD5

58dc734f0486efb9ff6b6b6066e114e0
SHA1

a5e210fd3e2f4e114549a567c71ab5e2a7054286
SHA256

6da34f82d5170e579f967053bc1ecfd27d2777b59ac25807d8dd5148c28748fb
SHA512

c6a238810bc6235a95a01e7ed25e16617b67704ff28bf19a4f9b599b218f3b6c2495c4a43e57f56d6e793a0da07aa54df92abdea25cb1bf14072e1f346e69f8a
SSDEEP

98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:IDqPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  58dc734f0486efb9ff6b6b6066e114e0_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  58dc734f0486efb9ff6b6b6066e114e0
- SHA1
  
  a5e210fd3e2f4e114549a567c71ab5e2a7054286
- SHA256
  
  6da34f82d5170e579f967053bc1ecfd27d2777b59ac25807d8dd5148c28748fb
- SHA512
  
  c6a238810bc6235a95a01e7ed25e16617b67704ff28bf19a4f9b599b218f3b6c2495c4a43e57f56d6e793a0da07aa54df92abdea25cb1bf14072e1f346e69f8a
- SSDEEP
  
  98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:IDqPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3306) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm