wannacry | 04af15b0eeeca5310566b14c58ecf68d71be2f9803a8d4bf64a95fc477c414e8 | Triage

Sharing

General

Target

2024-07-04_21dce6c905c9fbb2278e011ba90092f8_wannacry
Size

5.0MB
Sample

240704-pl7ggswhpj
MD5

21dce6c905c9fbb2278e011ba90092f8
SHA1

2297f04e64d6ead232f94e8b72e6b0268c1aec23
SHA256

04af15b0eeeca5310566b14c58ecf68d71be2f9803a8d4bf64a95fc477c414e8
SHA512

a6978fea520676ed11b76d104aa13a0e412251c734a0fd0a1da0a1e7866f0423cbf9aae3a112b89b56cc699e8cee3b3040bc941aeec82b95c1df13203cb5f589
SSDEEP

98304:DDqPoBhz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2H:DDqPe1Cxc7k3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-07-04_21dce6c905c9fbb2278e011ba90092f8_wannacry
- Size
  
  5.0MB
- MD5
  
  21dce6c905c9fbb2278e011ba90092f8
- SHA1
  
  2297f04e64d6ead232f94e8b72e6b0268c1aec23
- SHA256
  
  04af15b0eeeca5310566b14c58ecf68d71be2f9803a8d4bf64a95fc477c414e8
- SHA512
  
  a6978fea520676ed11b76d104aa13a0e412251c734a0fd0a1da0a1e7866f0423cbf9aae3a112b89b56cc699e8cee3b3040bc941aeec82b95c1df13203cb5f589
- SSDEEP
  
  98304:DDqPoBhz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2H:DDqPe1Cxc7k3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3268) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm