wannacry | 5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a | Triage

Submit
Reports

Overview

overview

Static

static

3

5ef8d00085...4a.exe

windows7-x64

5ef8d00085...4a.exe

windows10-2004-x64

Sharing

General

Target

5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a
Size

2.2MB
Sample

240902-19544sydqr
MD5

30530f95e73bb03e52eb2554996d509a
SHA1

8178d0f442b3b186f1e0da15c4524bb044cec6f4
SHA256

5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a
SHA512

32f2acf1b2236a7b015016790d7de21d1f36e18a53817c9b4c496a7114e0312033d064e0dcb477e7281936715402e14a3b6698239b6b5991cf9b2bde3054c3ef
SSDEEP

49152:QnpzMSPbcBVQej/1INgwuqzgX8knK4JKARp:QpzPoBhz1ay

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a.exe

Resource

win7-20240708-en

wannacry discovery ransomware worm

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a.exe

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a
- Size
  
  2.2MB
- MD5
  
  30530f95e73bb03e52eb2554996d509a
- SHA1
  
  8178d0f442b3b186f1e0da15c4524bb044cec6f4
- SHA256
  
  5ef8d0008552e723697e9164c8da769099c2833a2fa795208038eb2e1982f94a
- SHA512
  
  32f2acf1b2236a7b015016790d7de21d1f36e18a53817c9b4c496a7114e0312033d064e0dcb477e7281936715402e14a3b6698239b6b5991cf9b2bde3054c3ef
- SSDEEP
  
  49152:QnpzMSPbcBVQej/1INgwuqzgX8knK4JKARp:QpzPoBhz1ay
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3253) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy