wannacry | 1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d | Triage

Submit
Reports

Overview

overview

Static

static

3

1163f8c95c...8d.exe

windows7-x64

1163f8c95c...8d.exe

windows10-2004-x64

Sharing

General

Target

1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d
Size

5.0MB
Sample

240706-p19kdsycqk
MD5

0124d0954f620b8f3201b7f882432152
SHA1

167e72d824c2beb4f18b29ad28333fc7aafc417f
SHA256

1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d
SHA512

1b261cf9da11a8a387bc24f91f8ba6b1173366287060c548f7bfa4fad8cf4604c2d46697cdee2a163cc748d63cf82a6c9acbd87b4941319deb392a3c3123dc23
SSDEEP

49152:QnnMSPbcBVQejt1INRx+TSqTdX1HkQo6SA:QnPoBhJ1aRxcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d.exe

Resource

win7-20240705-en

wannacry discovery ransomware worm

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d.exe

Resource

win10v2004-20240704-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d
- Size
  
  5.0MB
- MD5
  
  0124d0954f620b8f3201b7f882432152
- SHA1
  
  167e72d824c2beb4f18b29ad28333fc7aafc417f
- SHA256
  
  1163f8c95cc797bc165727d95c38a184d9f5cbc83e90b1decb3106752573a58d
- SHA512
  
  1b261cf9da11a8a387bc24f91f8ba6b1173366287060c548f7bfa4fad8cf4604c2d46697cdee2a163cc748d63cf82a6c9acbd87b4941319deb392a3c3123dc23
- SSDEEP
  
  49152:QnnMSPbcBVQejt1INRx+TSqTdX1HkQo6SA:QnPoBhJ1aRxcSUDk36SA
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3165) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2025

Terms | Privacy