Overview

overview

10

Static

static

3

2024-11-15...ry.exe

windows7-x64

10

2024-11-15...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-15_21ebf4bdb8d11a23b91483d0f3ea3f63_wannacry

  • Size

    5.0MB

  • Sample

    241115-qmfktsvcrm

  • MD5

    21ebf4bdb8d11a23b91483d0f3ea3f63

  • SHA1

    d4eab5045bb29e6313f7b6819f52d7a3cf5b225d

  • SHA256

    74794b29f2771c2e1cd0e7653bc45b340f5239e8b47f33cc990d0f82320dcb3f

  • SHA512

    07054753849798a6e0c3a1d6f68e68ca7387c5d6b8a5ff61475fae203b142f80e9dc72af1560ae41b214ee51139d0e3152912ff208235069425f7a7039960b98

  • SSDEEP

    49152:VnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9dj:ZDqPoBhz1aRxcSUDk36SAEdhvxWa9dj

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      2024-11-15_21ebf4bdb8d11a23b91483d0f3ea3f63_wannacry

    • Size

      5.0MB

    • MD5

      21ebf4bdb8d11a23b91483d0f3ea3f63

    • SHA1

      d4eab5045bb29e6313f7b6819f52d7a3cf5b225d

    • SHA256

      74794b29f2771c2e1cd0e7653bc45b340f5239e8b47f33cc990d0f82320dcb3f

    • SHA512

      07054753849798a6e0c3a1d6f68e68ca7387c5d6b8a5ff61475fae203b142f80e9dc72af1560ae41b214ee51139d0e3152912ff208235069425f7a7039960b98

    • SSDEEP

      49152:VnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9dj:ZDqPoBhz1aRxcSUDk36SAEdhvxWa9dj

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Contacts a large (3098) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks