wannacry | cf3494f6313f1b474cc1c261a1cf94d1095212c62ed19a5ae16d9ab9fec5e57d | Triage

Sharing

General

Target

2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry
Size

5.0MB
Sample

241110-rqqewa1qhq
MD5

0ba0bc85f73eaff3c610778d903048d4
SHA1

476be04618e16f5876c2cb3ee0cb43c6a3c85779
SHA256

cf3494f6313f1b474cc1c261a1cf94d1095212c62ed19a5ae16d9ab9fec5e57d
SHA512

d43419db90c9e4fb1f4c89958803feafe68fc8f962f2ca543a33f3a1954146f446f5a35dfea715f699c95acb0b2763ab26ecebb07542735dbc4c16204b798f19
SSDEEP

98304:SDqPoBt1aRxcSUDk36SAEdhvxWa9P593R+:SDqPO1Cxcxk3ZAEUadzR

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry
- Size
  
  5.0MB
- MD5
  
  0ba0bc85f73eaff3c610778d903048d4
- SHA1
  
  476be04618e16f5876c2cb3ee0cb43c6a3c85779
- SHA256
  
  cf3494f6313f1b474cc1c261a1cf94d1095212c62ed19a5ae16d9ab9fec5e57d
- SHA512
  
  d43419db90c9e4fb1f4c89958803feafe68fc8f962f2ca543a33f3a1954146f446f5a35dfea715f699c95acb0b2763ab26ecebb07542735dbc4c16204b798f19
- SSDEEP
  
  98304:SDqPoBt1aRxcSUDk36SAEdhvxWa9P593R+:SDqPO1Cxcxk3ZAEUadzR
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (3145) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm