wannacry | ae70a934a5fb6aa90bedbfcd69d86be55c260696c2301d4bb15e7f5006198e06 | Triage

Sharing

General

Target

fde5064159734ca55bb4ec6795c630e1_JaffaCakes118
Size

3.6MB
Sample

240929-gah1ra1gnr
MD5

fde5064159734ca55bb4ec6795c630e1
SHA1

9eaec009d6e7a3005c5128c551fea62f89e2cfc2
SHA256

ae70a934a5fb6aa90bedbfcd69d86be55c260696c2301d4bb15e7f5006198e06
SHA512

39c6d436ebc9d33d34131ae308fc6a1dce6eba792b824407824e0182049cf32ed3341a698f1feed2abcdfaf6735163ae8559a0b53fe8d47e07c7d6e2d6201675
SSDEEP

98304:8DqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/J:8DqPe1Cxcxk3ZAEUadv

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  fde5064159734ca55bb4ec6795c630e1_JaffaCakes118
- Size
  
  3.6MB
- MD5
  
  fde5064159734ca55bb4ec6795c630e1
- SHA1
  
  9eaec009d6e7a3005c5128c551fea62f89e2cfc2
- SHA256
  
  ae70a934a5fb6aa90bedbfcd69d86be55c260696c2301d4bb15e7f5006198e06
- SHA512
  
  39c6d436ebc9d33d34131ae308fc6a1dce6eba792b824407824e0182049cf32ed3341a698f1feed2abcdfaf6735163ae8559a0b53fe8d47e07c7d6e2d6201675
- SSDEEP
  
  98304:8DqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/J:8DqPe1Cxcxk3ZAEUadv
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3088) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in Drivers directory
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm