wannacry | c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f | Triage

Submit
Reports

Overview

overview

Static

static

3

c7e7c351bb...9f.exe

windows7-x64

c7e7c351bb...9f.exe

windows10-2004-x64

Sharing

General

Target

c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f
Size

3.6MB
Sample

240917-pmz4sssfnb
MD5

2a4bceb90f5cfe83da4e3344a31341f5
SHA1

1b9a9fa1cd2e95c3ac014df06f2392b8964daee4
SHA256

c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f
SHA512

e11c9475b237af52ca343f39117caffcaf6510f4f7ac2c49a03392c5881569084987e29ac8e6996acd2ec890089ceab82c7ed3bf1222f75e554ee440a1c7d5bc
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhB3R8yAVp2HI:XDqPe1Cxcxk3ZAE1R8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f.exe

Resource

win7-20240704-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f.exe

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f
- Size
  
  3.6MB
- MD5
  
  2a4bceb90f5cfe83da4e3344a31341f5
- SHA1
  
  1b9a9fa1cd2e95c3ac014df06f2392b8964daee4
- SHA256
  
  c7e7c351bb813ceaf6047a0f94c7cd0a69291e15ea324f0a9440c1cbf8abba9f
- SHA512
  
  e11c9475b237af52ca343f39117caffcaf6510f4f7ac2c49a03392c5881569084987e29ac8e6996acd2ec890089ceab82c7ed3bf1222f75e554ee440a1c7d5bc
- SSDEEP
  
  98304:XDqPoBhz1aRxcSUDk36SAEdhB3R8yAVp2HI:XDqPe1Cxcxk3ZAE1R8yc4HI
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3312) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy