wannacry | a217bb27a47dc7eb7194d7da93d6b357f85414441f3125629789273d0b577302 | Triage

Sharing

General

Target

a217bb27a47dc7eb7194d7da93d6b357f85414441f3125629789273d0b577302.exe
Size

5.0MB
Sample

241202-l91r3awnej
MD5

92707e45cda91db9515975f898c059a7
SHA1

fd39e8b44777c9c53f8f8f4c1605894fcb9c5aa2
SHA256

a217bb27a47dc7eb7194d7da93d6b357f85414441f3125629789273d0b577302
SHA512

16a0a3b3086531b34e3f3b867af64c91da7c051897dc1f260ad4655b5bb8aca9c69fe2395dd024e408e12dee6b50f7c9fd11c5672bde6cba791b1da262af7cd8
SSDEEP

98304:g8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HY:g8qPe1Cxcxk3ZAEUadzR8yc4HY

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  a217bb27a47dc7eb7194d7da93d6b357f85414441f3125629789273d0b577302.exe
- Size
  
  5.0MB
- MD5
  
  92707e45cda91db9515975f898c059a7
- SHA1
  
  fd39e8b44777c9c53f8f8f4c1605894fcb9c5aa2
- SHA256
  
  a217bb27a47dc7eb7194d7da93d6b357f85414441f3125629789273d0b577302
- SHA512
  
  16a0a3b3086531b34e3f3b867af64c91da7c051897dc1f260ad4655b5bb8aca9c69fe2395dd024e408e12dee6b50f7c9fd11c5672bde6cba791b1da262af7cd8
- SSDEEP
  
  98304:g8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HY:g8qPe1Cxcxk3ZAEUadzR8yc4HY
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2434) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm