wannacry | 785182c541d1f181d2ba100b16790dc9e0fb78b6726069f6172d59cd54cb8f7c | Triage

Sharing

General

Target

785182c541d1f181d2ba100b16790dc9e0fb78b6726069f6172d59cd54cb8f7c
Size

2.2MB
Sample

240927-xs172sxcpg
MD5

1bdeb916e50eb41019378a17fb9c849e
SHA1

204ea386c141ad05d99c0e66f901c99ce5c7f515
SHA256

785182c541d1f181d2ba100b16790dc9e0fb78b6726069f6172d59cd54cb8f7c
SHA512

373d279a83c54f0b0f09218acdd80e3c44b99ed14a54257f4c21c4ec09c9d894f5f8429cc3060d247b97419e1bce72a883f84d78b85a6ab285ea67b7b607dcfa
SSDEEP

49152:vnjQqMSPbcBVQej/1INq+TSqTdX1HkQo6SAARdhnvn:/8qPoBhz1aqcSUDk36SAEdhvn

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  785182c541d1f181d2ba100b16790dc9e0fb78b6726069f6172d59cd54cb8f7c
- Size
  
  2.2MB
- MD5
  
  1bdeb916e50eb41019378a17fb9c849e
- SHA1
  
  204ea386c141ad05d99c0e66f901c99ce5c7f515
- SHA256
  
  785182c541d1f181d2ba100b16790dc9e0fb78b6726069f6172d59cd54cb8f7c
- SHA512
  
  373d279a83c54f0b0f09218acdd80e3c44b99ed14a54257f4c21c4ec09c9d894f5f8429cc3060d247b97419e1bce72a883f84d78b85a6ab285ea67b7b607dcfa
- SSDEEP
  
  49152:vnjQqMSPbcBVQej/1INq+TSqTdX1HkQo6SAARdhnvn:/8qPoBhz1aqcSUDk36SAEdhvn
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (790) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm