wannacry | 93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174 | Triage

Sharing

General

Target

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N
Size

3.6MB
Sample

241013-t91faswhlc
MD5

0ae789d084faa747a39862531340fcd0
SHA1

aa376c6bd968ab0d94352fa12e8774675ee1ad9d
SHA256

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174
SHA512

2c84e7b3f61a21dc5ced4cdf426ea8735d1fece4e762ad8e44f36eff0acf14a7e2201e95a3fe18960b36897ded55c8017bb65da809f60be3b0d1caa91696528a
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAO:Z8qPoBhz1aRxcSUDk36SAB

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N
- Size
  
  3.6MB
- MD5
  
  0ae789d084faa747a39862531340fcd0
- SHA1
  
  aa376c6bd968ab0d94352fa12e8774675ee1ad9d
- SHA256
  
  93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174
- SHA512
  
  2c84e7b3f61a21dc5ced4cdf426ea8735d1fece4e762ad8e44f36eff0acf14a7e2201e95a3fe18960b36897ded55c8017bb65da809f60be3b0d1caa91696528a
- SSDEEP
  
  49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAO:Z8qPoBhz1aRxcSUDk36SAB
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2458) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm