wannacry | 2589efaaa4f3eee564c93ecd69241427dcbe44ff53ff4b32ecde8043e3902a7c | Triage

Sharing

General

Target

a33573e465729d000fef090310806c4b_JaffaCakes118
Size

5.0MB
Sample

240613-a3tjmaxerh
MD5

a33573e465729d000fef090310806c4b
SHA1

e4351639982969ccd0d22d1d4285a507ff860900
SHA256

2589efaaa4f3eee564c93ecd69241427dcbe44ff53ff4b32ecde8043e3902a7c
SHA512

670be76ec4f949a87620ffe2af3387ced914de7f42ad4adb19d9f36ead662ca49e6b187923ea1b45d931e4004d0f66b5e44ce2c42b4ea980cb0867c283265d96
SSDEEP

98304:+DqPoBhz1a0TBBBBBBBBBBBBBBcBBBBBBBBBBBBBBVfBBBBBBBBBBBBBB5BBBBB+:+DqP21JBBBBBBBBBBBBBBcBBBBBBBBBK

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  a33573e465729d000fef090310806c4b_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  a33573e465729d000fef090310806c4b
- SHA1
  
  e4351639982969ccd0d22d1d4285a507ff860900
- SHA256
  
  2589efaaa4f3eee564c93ecd69241427dcbe44ff53ff4b32ecde8043e3902a7c
- SHA512
  
  670be76ec4f949a87620ffe2af3387ced914de7f42ad4adb19d9f36ead662ca49e6b187923ea1b45d931e4004d0f66b5e44ce2c42b4ea980cb0867c283265d96
- SSDEEP
  
  98304:+DqPoBhz1a0TBBBBBBBBBBBBBBcBBBBBBBBBBBBBBVfBBBBBBBBBBBBBB5BBBBB+:+DqP21JBBBBBBBBBBBBBBcBBBBBBBBBK
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2666) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm