wannacry | 6b671ff703de985340a36c6c52a1e1c461b3829d150c292da1391485e2f65ba4 | Triage

Sharing

General

Target

e514bafb4f6cc39e9a92eea46faddf72_JaffaCakes118
Size

5.0MB
Sample

240916-s4rqjavhng
MD5

e514bafb4f6cc39e9a92eea46faddf72
SHA1

0d1b1cb8e8b61f867d1a65847e79390448196085
SHA256

6b671ff703de985340a36c6c52a1e1c461b3829d150c292da1391485e2f65ba4
SHA512

b318cf8fd18111aeb7a8ae581d108fc0066fd4c51134adba56819d412e41124e5b79cbc27bf20da327c505501c356d0d46259de345c3f883efab52d02d250f6b
SSDEEP

49152:knAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:UDqPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  e514bafb4f6cc39e9a92eea46faddf72_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  e514bafb4f6cc39e9a92eea46faddf72
- SHA1
  
  0d1b1cb8e8b61f867d1a65847e79390448196085
- SHA256
  
  6b671ff703de985340a36c6c52a1e1c461b3829d150c292da1391485e2f65ba4
- SHA512
  
  b318cf8fd18111aeb7a8ae581d108fc0066fd4c51134adba56819d412e41124e5b79cbc27bf20da327c505501c356d0d46259de345c3f883efab52d02d250f6b
- SSDEEP
  
  49152:knAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:UDqPoBhz1aRxcSUDk36SA
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3284) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm