General

  • Target

    2024-10-12_15b9658ef1815c3c284ba3dec7efc087_wannacry

  • Size

    3.6MB

  • Sample

    241012-dk8sdatfnq

  • MD5

    15b9658ef1815c3c284ba3dec7efc087

  • SHA1

    2d958dd60204033f122e9c81244336ae89871920

  • SHA256

    0c06687cf1a672d3f0612f0664dbd751727347274adcfe99bd8d2641fc04b570

  • SHA512

    d050e639fc5de0ddd62cc17461283c4e0fd3bb69fdf6005f4fc7cc57a949c2ed7eb2faa074923add77bb93f1e44f8fdebdd01c29f0af7216c168260500104905

  • SSDEEP

    49152:6nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:WDqPoBhz1aRxcSUDk36SA

Malware Config

Targets

    • Target

      2024-10-12_15b9658ef1815c3c284ba3dec7efc087_wannacry

    • Size

      3.6MB

    • MD5

      15b9658ef1815c3c284ba3dec7efc087

    • SHA1

      2d958dd60204033f122e9c81244336ae89871920

    • SHA256

      0c06687cf1a672d3f0612f0664dbd751727347274adcfe99bd8d2641fc04b570

    • SHA512

      d050e639fc5de0ddd62cc17461283c4e0fd3bb69fdf6005f4fc7cc57a949c2ed7eb2faa074923add77bb93f1e44f8fdebdd01c29f0af7216c168260500104905

    • SSDEEP

      49152:6nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:WDqPoBhz1aRxcSUDk36SA

    • Modifies firewall policy service

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3051) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Drops file in Drivers directory

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks