wannacry | 93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174 | Triage

Submit
Reports

Overview

overview

Static

static

3

93128033bb...4N.exe

windows7-x64

93128033bb...4N.exe

windows10-2004-x64

Sharing

General

Target

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N
Size

3.6MB
Sample

241013-vfwqpa1grm
MD5

0ae789d084faa747a39862531340fcd0
SHA1

aa376c6bd968ab0d94352fa12e8774675ee1ad9d
SHA256

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174
SHA512

2c84e7b3f61a21dc5ced4cdf426ea8735d1fece4e762ad8e44f36eff0acf14a7e2201e95a3fe18960b36897ded55c8017bb65da809f60be3b0d1caa91696528a
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAO:Z8qPoBhz1aRxcSUDk36SAB

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N.exe

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N.exe

Resource

win10v2004-20241007-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174N
- Size
  
  3.6MB
- MD5
  
  0ae789d084faa747a39862531340fcd0
- SHA1
  
  aa376c6bd968ab0d94352fa12e8774675ee1ad9d
- SHA256
  
  93128033bba0937240ff448cf4c9e2539e6d3121e47bb5e5fde96af366a8b174
- SHA512
  
  2c84e7b3f61a21dc5ced4cdf426ea8735d1fece4e762ad8e44f36eff0acf14a7e2201e95a3fe18960b36897ded55c8017bb65da809f60be3b0d1caa91696528a
- SSDEEP
  
  49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAO:Z8qPoBhz1aRxcSUDk36SAB
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3354) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy