wannacry | c0057fd3141966017014beb71fa2e31d84d3ddd2a9f20e3e6ee26df8165a531f | Triage

Sharing

General

Target

tasksche.exe
Size

3.4MB
Sample

241204-n2k3razldk
MD5

a27cfbfad728fa5ec8e701a6f93cab26
SHA1

deba582c9c8f059590132395f987c2acf54e7a7f
SHA256

c0057fd3141966017014beb71fa2e31d84d3ddd2a9f20e3e6ee26df8165a531f
SHA512

8c095ccb3367903bc5498d0222ee537ef2bbd4f4204fe9a9a9babe2426d8a377240a15892e248e6e252bf3b229eecc8b1c960136988bf3398941e20a1e542b5d
SSDEEP

768:sCo1dAqfsxpWQUJIMsuEfVQuvPOpai+d03Baho9S4AJKqBz8MZVxPDMO9nq8t2Tf:Bo1Jfsh3MKNQugai++N9S4A3v9q/j

Score

10^/10

wannacry defense_evasion discovery ransomware worm

Malware Config

Targets

- Target
  
  tasksche.exe
- Size
  
  3.4MB
- MD5
  
  a27cfbfad728fa5ec8e701a6f93cab26
- SHA1
  
  deba582c9c8f059590132395f987c2acf54e7a7f
- SHA256
  
  c0057fd3141966017014beb71fa2e31d84d3ddd2a9f20e3e6ee26df8165a531f
- SHA512
  
  8c095ccb3367903bc5498d0222ee537ef2bbd4f4204fe9a9a9babe2426d8a377240a15892e248e6e252bf3b229eecc8b1c960136988bf3398941e20a1e542b5d
- SSDEEP
  
  768:sCo1dAqfsxpWQUJIMsuEfVQuvPOpai+d03Baho9S4AJKqBz8MZVxPDMO9nq8t2Tf:Bo1Jfsh3MKNQugai++N9S4A3v9q/j
Score

10^/10

wannacry defense_evasion discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Modifies file permissions
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydefense_evasiondiscoveryransomwareworm

behavioral2

wannacrydefense_evasiondiscoveryransomwareworm