wannacry | add3c3558755047086dca5f6bf13fabd46c42b3b0c3a9c51a015bd0e3ef92e13 | Triage

Sharing

General

Target

add3c3558755047086dca5f6bf13fabd46c42b3b0c3a9c51a015bd0e3ef92e13N.exe
Size

5.0MB
Sample

241212-xntmeawkal
MD5

dcd481dba5974e52fcdf0938c1b19590
SHA1

776221aaf08aa63593a531502b5558dde14eaf9a
SHA256

add3c3558755047086dca5f6bf13fabd46c42b3b0c3a9c51a015bd0e3ef92e13
SHA512

7e866e9102fda7416a9a2b3894743896161453903383e21d718ecb5e6508319361f17f618ce510ac44c3a67a4e4ae5e8db6948de2d564a2219e62e97a53710fb
SSDEEP

6144:eE9l9ynRIYVTH5DgSgNajldktM0XXrCIai62XVIwYQuy8DLq1eN:e1bLgmluCti62lIMu7L5N

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  add3c3558755047086dca5f6bf13fabd46c42b3b0c3a9c51a015bd0e3ef92e13N.exe
- Size
  
  5.0MB
- MD5
  
  dcd481dba5974e52fcdf0938c1b19590
- SHA1
  
  776221aaf08aa63593a531502b5558dde14eaf9a
- SHA256
  
  add3c3558755047086dca5f6bf13fabd46c42b3b0c3a9c51a015bd0e3ef92e13
- SHA512
  
  7e866e9102fda7416a9a2b3894743896161453903383e21d718ecb5e6508319361f17f618ce510ac44c3a67a4e4ae5e8db6948de2d564a2219e62e97a53710fb
- SSDEEP
  
  6144:eE9l9ynRIYVTH5DgSgNajldktM0XXrCIai62XVIwYQuy8DLq1eN:e1bLgmluCti62lIMu7L5N
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2467) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm