wannacry | 148130feddfc15bede2379d818531fc2f37d7cf1ede4ca6fdea5c7f6dedfb3eb | Triage

Sharing

General

Target

2024-09-16_48102ff8f988d28200ab111e29fd4e6f_wannacry
Size

5.0MB
Sample

240916-tjsb1awgnd
MD5

48102ff8f988d28200ab111e29fd4e6f
SHA1

d983177d44d9e70b47fa22b94abd069aedceed1f
SHA256

148130feddfc15bede2379d818531fc2f37d7cf1ede4ca6fdea5c7f6dedfb3eb
SHA512

1bfb2f863ce4404459e9522e3d57e70f1961154e68320aaf819e42d7b0609a4e880b4643cd99d9bf38f102fdd697f20d76ffe8b92605d5f444f6fb08a745a9dd
SSDEEP

98304:kDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:kDqPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-09-16_48102ff8f988d28200ab111e29fd4e6f_wannacry
- Size
  
  5.0MB
- MD5
  
  48102ff8f988d28200ab111e29fd4e6f
- SHA1
  
  d983177d44d9e70b47fa22b94abd069aedceed1f
- SHA256
  
  148130feddfc15bede2379d818531fc2f37d7cf1ede4ca6fdea5c7f6dedfb3eb
- SHA512
  
  1bfb2f863ce4404459e9522e3d57e70f1961154e68320aaf819e42d7b0609a4e880b4643cd99d9bf38f102fdd697f20d76ffe8b92605d5f444f6fb08a745a9dd
- SSDEEP
  
  98304:kDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:kDqPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3337) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in Drivers directory
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm