wannacry | e8ffec081427438b558c4a0c9e142ac8de18b5e53654d63cebcb75cacca44c98 | Triage

Submit
Reports

Overview

overview

Static

static

3

20240929f6...ry.exe

windows7-x64

20240929f6...ry.exe

windows10-2004-x64

Sharing

General

Target

20240929f6a77c581de44e5572a614c439e5de0cwannacry
Size

5.0MB
Sample

240929-szzwcataqe
MD5

f6a77c581de44e5572a614c439e5de0c
SHA1

fbe1fe50ab09de43c1383655466e1d42321a0dbd
SHA256

e8ffec081427438b558c4a0c9e142ac8de18b5e53654d63cebcb75cacca44c98
SHA512

63274d7fc9d35154745076b8463d45ea8fe166443f0dd9562d84330348589c35581febfc9b137d7a41d44dd807094f61456cc6fa213121d64a512e44aceba33b
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6PxJM0H9PAMEcaEaGCnV:yDqPoBhz1aRxcSUDk36PxWa9P5J8V

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

20240929f6a77c581de44e5572a614c439e5de0cwannacry.exe

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

20240929f6a77c581de44e5572a614c439e5de0cwannacry.exe

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  20240929f6a77c581de44e5572a614c439e5de0cwannacry
- Size
  
  5.0MB
- MD5
  
  f6a77c581de44e5572a614c439e5de0c
- SHA1
  
  fbe1fe50ab09de43c1383655466e1d42321a0dbd
- SHA256
  
  e8ffec081427438b558c4a0c9e142ac8de18b5e53654d63cebcb75cacca44c98
- SHA512
  
  63274d7fc9d35154745076b8463d45ea8fe166443f0dd9562d84330348589c35581febfc9b137d7a41d44dd807094f61456cc6fa213121d64a512e44aceba33b
- SSDEEP
  
  49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6PxJM0H9PAMEcaEaGCnV:yDqPoBhz1aRxcSUDk36PxWa9P5J8V
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3337) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy