wannacry | fba95e20786970421b27d5e6a2f753abf9614ba8407bc3db66232b3db84eaaac | Triage

Sharing

General

Target

2025-01-11_2da24b5551b6783696b5a502f756980e_wannacry
Size

3.6MB
Sample

250111-bwmm6szkem
MD5

2da24b5551b6783696b5a502f756980e
SHA1

1146e39f64c08f697e637605ef949574812f927c
SHA256

fba95e20786970421b27d5e6a2f753abf9614ba8407bc3db66232b3db84eaaac
SHA512

6a8e8805fc534917ab593ad0dcdd8f4fc385ba490a6553490a22c2132937c8cda1feb31aebeac6b48ea6c99bae6ec66099153c4d6b5c153eeabf2a97fd87f52c
SSDEEP

98304:CdPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hc:CdPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Targets

- Target
  
  2025-01-11_2da24b5551b6783696b5a502f756980e_wannacry
- Size
  
  3.6MB
- MD5
  
  2da24b5551b6783696b5a502f756980e
- SHA1
  
  1146e39f64c08f697e637605ef949574812f927c
- SHA256
  
  fba95e20786970421b27d5e6a2f753abf9614ba8407bc3db66232b3db84eaaac
- SHA512
  
  6a8e8805fc534917ab593ad0dcdd8f4fc385ba490a6553490a22c2132937c8cda1feb31aebeac6b48ea6c99bae6ec66099153c4d6b5c153eeabf2a97fd87f52c
- SSDEEP
  
  98304:CdPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hc:CdPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm evasion
- Modifies firewall policy service
  evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (3201) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in Drivers directory
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryevasionransomwareworm