General

  • Target

    2024-08-17_b8755ef6ad476b5c3d5d801af554d6b2_wannacry

  • Size

    5.0MB

  • Sample

    240817-jls17sxhnl

  • MD5

    b8755ef6ad476b5c3d5d801af554d6b2

  • SHA1

    41937fa0343af2682b4e40c0d3c48a01f0f552a5

  • SHA256

    8196752e9a340a78fe1461f38b2aa2fa5541ec162dbde4c7bdc189293dfbb7d9

  • SHA512

    09b5878301985c41a5fe519a44331fd221869447e347ebe91ee8aae8cd193f7a834f59e133fbff602689877d4f4c9fb97edfa7286f1df5376a304084f9aaeba0

  • SSDEEP

    98304:G8qPoBhz1aRxcSUDk36SAEdhvxWa9P5xD527BWG:G8qPe1Cxcxk3ZAEUadXVQBWG

Malware Config

Targets

    • Target

      2024-08-17_b8755ef6ad476b5c3d5d801af554d6b2_wannacry

    • Size

      5.0MB

    • MD5

      b8755ef6ad476b5c3d5d801af554d6b2

    • SHA1

      41937fa0343af2682b4e40c0d3c48a01f0f552a5

    • SHA256

      8196752e9a340a78fe1461f38b2aa2fa5541ec162dbde4c7bdc189293dfbb7d9

    • SHA512

      09b5878301985c41a5fe519a44331fd221869447e347ebe91ee8aae8cd193f7a834f59e133fbff602689877d4f4c9fb97edfa7286f1df5376a304084f9aaeba0

    • SSDEEP

      98304:G8qPoBhz1aRxcSUDk36SAEdhvxWa9P5xD527BWG:G8qPe1Cxcxk3ZAEUadXVQBWG

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3186) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks