wannacry | 56e9b59c326a9802d8c1fedb0deed00ca00acb05e86677759584a8f88962b3bc | Triage

Sharing

General

Target

2024-06-23_3ae428cefe66c7a6e5429939e81571d7_wannacry
Size

3.6MB
Sample

240623-lfqp1a1fjp
MD5

3ae428cefe66c7a6e5429939e81571d7
SHA1

dd3353e05a29e7adaa542d959bbdd3418f029bbb
SHA256

56e9b59c326a9802d8c1fedb0deed00ca00acb05e86677759584a8f88962b3bc
SHA512

ee74237b038445787681854abd924106746b82ae9c3176f752ed1bc84e2e91563240e1b666e4e1b4dec126a6523867ea3d72d163f73500f51360c3979d813ac5
SSDEEP

98304:MDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:MDqPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-06-23_3ae428cefe66c7a6e5429939e81571d7_wannacry
- Size
  
  3.6MB
- MD5
  
  3ae428cefe66c7a6e5429939e81571d7
- SHA1
  
  dd3353e05a29e7adaa542d959bbdd3418f029bbb
- SHA256
  
  56e9b59c326a9802d8c1fedb0deed00ca00acb05e86677759584a8f88962b3bc
- SHA512
  
  ee74237b038445787681854abd924106746b82ae9c3176f752ed1bc84e2e91563240e1b666e4e1b4dec126a6523867ea3d72d163f73500f51360c3979d813ac5
- SSDEEP
  
  98304:MDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:MDqPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3155) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm