wannacry | e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37 | Triage

Sharing

General

Target

a48ca7b40ab2a6ebdd94dbd52164c6cf_JaffaCakes118
Size

5.0MB
Sample

240817-3blnxswaql
MD5

a48ca7b40ab2a6ebdd94dbd52164c6cf
SHA1

9203753bc934a2ae18c94b1127905f277316b481
SHA256

e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37
SHA512

f028aedb790d2f1135a06ae5ba037e607a23b209aeb3115bc4f05a6bca7405136d92e7674ec2f3b115e93ab4cf487c74919c2824dc81406cfc13f0135b6ebcb0
SSDEEP

49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1GPoBhz1aRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  a48ca7b40ab2a6ebdd94dbd52164c6cf_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  a48ca7b40ab2a6ebdd94dbd52164c6cf
- SHA1
  
  9203753bc934a2ae18c94b1127905f277316b481
- SHA256
  
  e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37
- SHA512
  
  f028aedb790d2f1135a06ae5ba037e607a23b209aeb3115bc4f05a6bca7405136d92e7674ec2f3b115e93ab4cf487c74919c2824dc81406cfc13f0135b6ebcb0
- SSDEEP
  
  49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1GPoBhz1aRxcSUDk36SAEdhv
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2116) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm