Overview

overview

10

Static

static

3

2024-05-22...ry.exe

windows7-x64

10

2024-05-22...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-22_66b835cf087b02057d30f1e5018faf4f_wannacry

  • Size

    5.0MB

  • Sample

    240522-hcv9jafb33

  • MD5

    66b835cf087b02057d30f1e5018faf4f

  • SHA1

    18cad1a39e405b6ec3cd2877a66f28b31d09892f

  • SHA256

    ae0093778263536f54879fff2b2091e2693b59c80b1b582e3a2c76b6602bf744

  • SHA512

    0bf0f9d1e47e6c829eb6db955d0ecb21c5b4666f4698fab7fca409257837755fd6fd83a8e6321357b5cec0ebf33f048e2e167a0401fb0a743afe229b061b9756

  • SSDEEP

    98304:gDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HbD527BWG:gDqPe1Cxcxk3ZAEUadzR8yc4HbVQBWG

Score
10/10
wannacrydiscoveryransomwarespywarestealerworm

Malware Config

Targets

    • Target

      2024-05-22_66b835cf087b02057d30f1e5018faf4f_wannacry

    • Size

      5.0MB

    • MD5

      66b835cf087b02057d30f1e5018faf4f

    • SHA1

      18cad1a39e405b6ec3cd2877a66f28b31d09892f

    • SHA256

      ae0093778263536f54879fff2b2091e2693b59c80b1b582e3a2c76b6602bf744

    • SHA512

      0bf0f9d1e47e6c829eb6db955d0ecb21c5b4666f4698fab7fca409257837755fd6fd83a8e6321357b5cec0ebf33f048e2e167a0401fb0a743afe229b061b9756

    • SSDEEP

      98304:gDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HbD527BWG:gDqPe1Cxcxk3ZAEUadzR8yc4HbVQBWG

    Score
    10/10
    wannacrydiscoveryransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3076) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

2
T1046

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks