wannacry | 43fafc6b49e4c26e512c2c268108cbed57360337c76711781083d81cc66e7d0e | Triage

Sharing

General

Target

18aebed1b042a614a191f67c82847dc3_JaffaCakes118
Size

3.7MB
Sample

240628-ee82mazdjd
MD5

18aebed1b042a614a191f67c82847dc3
SHA1

4c547aff8c924460349359e28f5a55d8e4c64fe0
SHA256

43fafc6b49e4c26e512c2c268108cbed57360337c76711781083d81cc66e7d0e
SHA512

6667d0b47c261dd0bf8432c7bffc1c6420b1601170ba095eb40eebdd3ab5d552c26c0dfe6841ac40fcad59af56fada034dbf7a65d3dc89e56b6cb786baeffe9d
SSDEEP

98304:qevW/gJu8PlXLRQ51wSDqUK8ASwJTUcIZ+P48bekAjRr3L3YR9iCHGH:5O6pUKT8oPbbekA9U9iIGH

Score

10^/10

wannacry defense_evasion discovery persistence ransomware spyware stealer worm

Malware Config

Targets

- Target
  
  18aebed1b042a614a191f67c82847dc3_JaffaCakes118
- Size
  
  3.7MB
- MD5
  
  18aebed1b042a614a191f67c82847dc3
- SHA1
  
  4c547aff8c924460349359e28f5a55d8e4c64fe0
- SHA256
  
  43fafc6b49e4c26e512c2c268108cbed57360337c76711781083d81cc66e7d0e
- SHA512
  
  6667d0b47c261dd0bf8432c7bffc1c6420b1601170ba095eb40eebdd3ab5d552c26c0dfe6841ac40fcad59af56fada034dbf7a65d3dc89e56b6cb786baeffe9d
- SSDEEP
  
  98304:qevW/gJu8PlXLRQ51wSDqUK8ASwJTUcIZ+P48bekAjRr3L3YR9iCHGH:5O6pUKT8oPbbekA9U9iIGH
Score

10^/10

wannacry defense_evasion discovery persistence ransomware worm spyware stealer
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydefense_evasiondiscoverypersistenceransomwareworm

behavioral2

wannacrydefense_evasiondiscoverypersistenceransomwarespywarestealerworm