wannacry | a81827b65bb4e716e468b430aa64b152b7aa8e23712b36443a59e0e244c0abd8 | Triage

Sharing

General

Target

2024-06-04_9c95e5e0e83b3048ad2f57260326cc6f_wannacry
Size

5.0MB
Sample

240604-n78e8sfe3t
MD5

9c95e5e0e83b3048ad2f57260326cc6f
SHA1

54b42bebaa997beb70e79044a91e81009f523a00
SHA256

a81827b65bb4e716e468b430aa64b152b7aa8e23712b36443a59e0e244c0abd8
SHA512

444236674b844714b3adf2b8291350dbf195b3c751072165abee5c8e3824a6520c1b497e0e87544c2baff99eb9a87a3f7b939fac7a9cb8dac64b6e0b700f3176
SSDEEP

49152:OnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:6DqPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-06-04_9c95e5e0e83b3048ad2f57260326cc6f_wannacry
- Size
  
  5.0MB
- MD5
  
  9c95e5e0e83b3048ad2f57260326cc6f
- SHA1
  
  54b42bebaa997beb70e79044a91e81009f523a00
- SHA256
  
  a81827b65bb4e716e468b430aa64b152b7aa8e23712b36443a59e0e244c0abd8
- SHA512
  
  444236674b844714b3adf2b8291350dbf195b3c751072165abee5c8e3824a6520c1b497e0e87544c2baff99eb9a87a3f7b939fac7a9cb8dac64b6e0b700f3176
- SSDEEP
  
  49152:OnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:6DqPoBhz1aRxcSUDk36SA
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3304) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm