wannacry | 798f44b4f8e438e7eef7394b1a7dc4de221b46985c0dc25561c7dd41f051be16 | Triage

Sharing

General

Target

798f44b4f8e438e7eef7394b1a7dc4de221b46985c0dc25561c7dd41f051be16.exe
Size

3.6MB
Sample

250111-eth4ratjet
MD5

583e79d805cfd365d6cece8cfa1ce0d2
SHA1

c2ce3f6d695a4c40727c9f9a98bc46dd03079f32
SHA256

798f44b4f8e438e7eef7394b1a7dc4de221b46985c0dc25561c7dd41f051be16
SHA512

2778e93f9c6ef4a1c22c152d6eed3b114830b62cfa13f661765e7bbb9c9aa1849c02f2bacd0e86a633514a1feb204c4c49f3e148379a5b0ee10390e3afebf9a2
SSDEEP

24576:XbLgddQhfdmMSirYbcMNge71cPXTZd1+IE8SBk4GhGP5qfl8J0a7:XnAQqMSPbcBu1cPoykP5qN8ya7

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  798f44b4f8e438e7eef7394b1a7dc4de221b46985c0dc25561c7dd41f051be16.exe
- Size
  
  3.6MB
- MD5
  
  583e79d805cfd365d6cece8cfa1ce0d2
- SHA1
  
  c2ce3f6d695a4c40727c9f9a98bc46dd03079f32
- SHA256
  
  798f44b4f8e438e7eef7394b1a7dc4de221b46985c0dc25561c7dd41f051be16
- SHA512
  
  2778e93f9c6ef4a1c22c152d6eed3b114830b62cfa13f661765e7bbb9c9aa1849c02f2bacd0e86a633514a1feb204c4c49f3e148379a5b0ee10390e3afebf9a2
- SSDEEP
  
  24576:XbLgddQhfdmMSirYbcMNge71cPXTZd1+IE8SBk4GhGP5qfl8J0a7:XnAQqMSPbcBu1cPoykP5qN8ya7
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2487) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm