wannacry | 8f3a88e331e468c684b36fb90d04cbacdc7c1ec5b43303857ac8bdb8afe2724b | Triage

Sharing

General

Target

2024-06-23_5ee16d20f3380c5dacbf26f74434b44f_wannacry
Size

3.6MB
Sample

240623-m7emgsyepe
MD5

5ee16d20f3380c5dacbf26f74434b44f
SHA1

f721a0d478347c8dafcb48884d42d62391965e51
SHA256

8f3a88e331e468c684b36fb90d04cbacdc7c1ec5b43303857ac8bdb8afe2724b
SHA512

7bf19fb6824781418a0e88e3b69fffff452e8aa6b2bbc03718094f41ed456fcff6a8ff069e1f44c6f7a9f1343b9b26fc186750c4dd0442a2a68ee3ac9b3b7692
SSDEEP

98304:4DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:4DqPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-06-23_5ee16d20f3380c5dacbf26f74434b44f_wannacry
- Size
  
  3.6MB
- MD5
  
  5ee16d20f3380c5dacbf26f74434b44f
- SHA1
  
  f721a0d478347c8dafcb48884d42d62391965e51
- SHA256
  
  8f3a88e331e468c684b36fb90d04cbacdc7c1ec5b43303857ac8bdb8afe2724b
- SHA512
  
  7bf19fb6824781418a0e88e3b69fffff452e8aa6b2bbc03718094f41ed456fcff6a8ff069e1f44c6f7a9f1343b9b26fc186750c4dd0442a2a68ee3ac9b3b7692
- SSDEEP
  
  98304:4DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:4DqPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2666) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in Drivers directory
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm