wannacry | 0ea794649437081a7e11a51df5bc4967f81aca4f7e052709aaad14baf8a2b1c4 | Triage

Submit
Reports

Overview

overview

Static

static

3

2024100257...ry.exe

windows7-x64

2024100257...ry.exe

windows10-2004-x64

Sharing

General

Target

2024100257948559589d32ebea479bd67229e460wannacry
Size

5.0MB
Sample

241002-ndsspaxcjg
MD5

57948559589d32ebea479bd67229e460
SHA1

3880785a75013758acc55be2c4e82934a1ae7a58
SHA256

0ea794649437081a7e11a51df5bc4967f81aca4f7e052709aaad14baf8a2b1c4
SHA512

5040c4546cb43c9c35baeca4ddb080733d9d9ce39c191aa1aa9d38072ba111dde2135aa6a17a8c8da24e2d276922aedd6d64374ec5635cfc342c13bbe67ac971
SSDEEP

49152:QnuQqMSPbcBVQej/VINRx+TSqTdd1HkQo6SAARdhnv:QZqPoBhzVaRxcSUZk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2024100257948559589d32ebea479bd67229e460wannacry.exe

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

2024100257948559589d32ebea479bd67229e460wannacry.exe

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024100257948559589d32ebea479bd67229e460wannacry
- Size
  
  5.0MB
- MD5
  
  57948559589d32ebea479bd67229e460
- SHA1
  
  3880785a75013758acc55be2c4e82934a1ae7a58
- SHA256
  
  0ea794649437081a7e11a51df5bc4967f81aca4f7e052709aaad14baf8a2b1c4
- SHA512
  
  5040c4546cb43c9c35baeca4ddb080733d9d9ce39c191aa1aa9d38072ba111dde2135aa6a17a8c8da24e2d276922aedd6d64374ec5635cfc342c13bbe67ac971
- SSDEEP
  
  49152:QnuQqMSPbcBVQej/VINRx+TSqTdd1HkQo6SAARdhnv:QZqPoBhzVaRxcSUZk36SAEdhv
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3341) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy