wannacry | cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9 | Triage

Sharing

General

Target

cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Size

5.0MB
Sample

241219-bcr4jszlaz
MD5

400cf8c6a860b2778da44e732ca3bc1f
SHA1

2e860c5598f9b53b38e50f103b8e1917fc613a3c
SHA256

cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9
SHA512

0be046f987ad9c717c6dddae7bd897af29fc31e41cf862b1966b2a1861c8c60493127a340c6fa961a5e2031464160155f04dd2564b2a8267a9d6b476b41aec1e
SSDEEP

24576:XbLgddQhfdmMSirYbcMNgef0QeQjGDdhAdmv1LJMfcH9PO6LLuYz:XnAQqMSPbcBVQejDdhnvxJM0H9Pz

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
- Size
  
  5.0MB
- MD5
  
  400cf8c6a860b2778da44e732ca3bc1f
- SHA1
  
  2e860c5598f9b53b38e50f103b8e1917fc613a3c
- SHA256
  
  cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9
- SHA512
  
  0be046f987ad9c717c6dddae7bd897af29fc31e41cf862b1966b2a1861c8c60493127a340c6fa961a5e2031464160155f04dd2564b2a8267a9d6b476b41aec1e
- SSDEEP
  
  24576:XbLgddQhfdmMSirYbcMNgef0QeQjGDdhAdmv1LJMfcH9PO6LLuYz:XnAQqMSPbcBVQejDdhnvxJM0H9Pz
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2378) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm