wannacry | 7eced83baacd8d067d1195f9cdaaafbd0c4b01ded6e95b12b5d454f94dea6aff | Triage

Sharing

General

Target

bba03983985f409dcce98254b5b58858_JaffaCakes118
Size

5.0MB
Sample

240618-nbb26a1clb
MD5

bba03983985f409dcce98254b5b58858
SHA1

91498d7ce5a97e2838c1a32432fb36389eef0cd7
SHA256

7eced83baacd8d067d1195f9cdaaafbd0c4b01ded6e95b12b5d454f94dea6aff
SHA512

67336bd633b9db2537f59315cefed371db925f07a246741c5aa306f81c801d1a876ffccdfaa2d77ef370e2a88936d31314987842c0e44bf78a6e5fd00acb23e9
SSDEEP

49152:CnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:uDqPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  bba03983985f409dcce98254b5b58858_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  bba03983985f409dcce98254b5b58858
- SHA1
  
  91498d7ce5a97e2838c1a32432fb36389eef0cd7
- SHA256
  
  7eced83baacd8d067d1195f9cdaaafbd0c4b01ded6e95b12b5d454f94dea6aff
- SHA512
  
  67336bd633b9db2537f59315cefed371db925f07a246741c5aa306f81c801d1a876ffccdfaa2d77ef370e2a88936d31314987842c0e44bf78a6e5fd00acb23e9
- SSDEEP
  
  49152:CnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:uDqPoBhz1aRxcSUDk36SA
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3253) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm