wannacry | 0b886fb6271e64b7e03a1d5282c762abf6909f2cc3dc404be4e9c6f840c57ac3 | Triage

Sharing

General

Target

2025-02-05_0ffda31625ee555b48e708c7abd398b6_wannacry
Size

3.6MB
Sample

250205-lqy45a1khx
MD5

0ffda31625ee555b48e708c7abd398b6
SHA1

56e7dc2990c61e61943392a9ca4478357b822546
SHA256

0b886fb6271e64b7e03a1d5282c762abf6909f2cc3dc404be4e9c6f840c57ac3
SHA512

3987514b03ddabd7102d88f3bdcc32fa9ff41f322a6581da2dfcb183b0323b4d9d7f5f5d782b3011bee04f8fa957c70a6e1ffd60edfe1b7fb3b38f6484e387c9
SSDEEP

98304:nDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:nDqPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry defense_evasion discovery ransomware worm

Malware Config

Targets

- Target
  
  2025-02-05_0ffda31625ee555b48e708c7abd398b6_wannacry
- Size
  
  3.6MB
- MD5
  
  0ffda31625ee555b48e708c7abd398b6
- SHA1
  
  56e7dc2990c61e61943392a9ca4478357b822546
- SHA256
  
  0b886fb6271e64b7e03a1d5282c762abf6909f2cc3dc404be4e9c6f840c57ac3
- SHA512
  
  3987514b03ddabd7102d88f3bdcc32fa9ff41f322a6581da2dfcb183b0323b4d9d7f5f5d782b3011bee04f8fa957c70a6e1ffd60edfe1b7fb3b38f6484e387c9
- SSDEEP
  
  98304:nDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:nDqPe1Cxcxk3ZAEUadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm defense_evasion
- Modifies firewall policy service
  defense_evasion
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (3263) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in Drivers directory
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydefense_evasiondiscoveryransomwareworm