wannacry | 48a2392f271850c0e467706c315daaf8c712c45288aa42bfd60b015ea1d1f68c | Triage

Submit
Reports

Overview

overview

Static

static

3

2025-02-03...ry.exe

windows7-x64

2025-02-03...ry.exe

windows10-2004-x64

Sharing

General

Target

2025-02-03_04613c493462f140a68b2568b25cde2b_wannacry
Size

5.0MB
Sample

250203-s6rtbavpew
MD5

04613c493462f140a68b2568b25cde2b
SHA1

7354f468d1c078caf65f2c6fc5cf869572ed4722
SHA256

48a2392f271850c0e467706c315daaf8c712c45288aa42bfd60b015ea1d1f68c
SHA512

2d31db50908432789f3bf17e4c599d365803443e12b02b10573894083256a77a9639eb628afde586e087b0693345a84bdc923e787eb022bd5da7178bb5182081
SSDEEP

98304:BDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HhD527BWG:BDqPe1Cxcxk3ZAEUadzR8yc4HhVQBWG

Score

10^/10

wannacry discovery ransomware spyware stealer worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2025-02-03_04613c493462f140a68b2568b25cde2b_wannacry.exe

Resource

win7-20240903-en

wannacry discovery ransomware spyware stealer worm

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral2

Sample

2025-02-03_04613c493462f140a68b2568b25cde2b_wannacry.exe

Resource

win10v2004-20250129-en

wannacry discovery ransomware spyware stealer worm

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  2025-02-03_04613c493462f140a68b2568b25cde2b_wannacry
- Size
  
  5.0MB
- MD5
  
  04613c493462f140a68b2568b25cde2b
- SHA1
  
  7354f468d1c078caf65f2c6fc5cf869572ed4722
- SHA256
  
  48a2392f271850c0e467706c315daaf8c712c45288aa42bfd60b015ea1d1f68c
- SHA512
  
  2d31db50908432789f3bf17e4c599d365803443e12b02b10573894083256a77a9639eb628afde586e087b0693345a84bdc923e787eb022bd5da7178bb5182081
- SSDEEP
  
  98304:BDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HhD527BWG:BDqPe1Cxcxk3ZAEUadzR8yc4HhVQBWG
Score

10^/10

wannacry discovery ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (2711) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Network Service Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwarespywarestealerworm

behavioral2

wannacrydiscoveryransomwarespywarestealerworm

© 2018-2025

Terms | Privacy