wannacry | 6159dace03bfb112365f97e0b6c766d88c7c39aa664d02720a084f3e9865e83d | Triage

Sharing

General

Target

4fd40831a348bddbf12dbda03a2bfb70N
Size

3.6MB
Sample

240911-q85f3svanh
MD5

4fd40831a348bddbf12dbda03a2bfb70
SHA1

35c3f9453904cedbf9a049612944431aaca51415
SHA256

6159dace03bfb112365f97e0b6c766d88c7c39aa664d02720a084f3e9865e83d
SHA512

94c4ee06d2e040cf85a189c1989e1a286bfb6e56dec6c1012c1465f8f5362ec7ec39f50f4bfa27caf71682ba8de31375f7cd89c7543f21fde9f7c1511f6a0919
SSDEEP

98304:XJPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:XJPe1Cxcxk3ZAEUadzR8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  4fd40831a348bddbf12dbda03a2bfb70N
- Size
  
  3.6MB
- MD5
  
  4fd40831a348bddbf12dbda03a2bfb70
- SHA1
  
  35c3f9453904cedbf9a049612944431aaca51415
- SHA256
  
  6159dace03bfb112365f97e0b6c766d88c7c39aa664d02720a084f3e9865e83d
- SHA512
  
  94c4ee06d2e040cf85a189c1989e1a286bfb6e56dec6c1012c1465f8f5362ec7ec39f50f4bfa27caf71682ba8de31375f7cd89c7543f21fde9f7c1511f6a0919
- SSDEEP
  
  98304:XJPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:XJPe1Cxcxk3ZAEUadzR8yc4HI
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2303) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm