wannacry | cd15268ec6fa0e3c588fcba5e20d957d6dee8499cef97d269b6bc4e3196d27bf | Triage

Sharing

General

Target

250413-z9x8tssps5_pw_infected.zip
Size

3.4MB
Sample

250413-126exavxat
MD5

1ec922f847b26314977252edc73e0200
SHA1

ab26a395821c2412c3995f4218e62ef25e9f2b6c
SHA256

cd15268ec6fa0e3c588fcba5e20d957d6dee8499cef97d269b6bc4e3196d27bf
SHA512

b9ec9f1647bc2b3f2233947aa3868d2f3782f76371de2f5cdbd030fac42ddcadac7df3152b9ab450f44bbf3d6e7a8a6b70bc5ccd17264a30f823851652809728
SSDEEP

98304:okYF3IlhCLWLLXhxv5FpeggYxIMJ5PKgF3q2UjPOaJ5i:oDdIlMsX3peU/CgFa2ULOg5i

Score

10^/10

wannacry discovery ransomware spyware stealer worm

Malware Config

Targets

- Target
  
  2025-04-13_aa7a2706d8d9bd8b28df9a3943cc421a_elex_wannacry
- Size
  
  5.0MB
- MD5
  
  aa7a2706d8d9bd8b28df9a3943cc421a
- SHA1
  
  d1d33606dec9318cce0ac8346e958b8cfea10f6f
- SHA256
  
  bde0f9f9e083f4147191699a057b0a9d0d46c71d2bf65f23893def6b8f908825
- SHA512
  
  eac8b1fa49003501d46dfcfe431bf1b7d9bd852768691524ff2a867a0fb491783e0f4e23d261186415f7dc2f60458faaa8b1f2889dd093c5d8be40ecd86695a1
- SSDEEP
  
  98304:sDqPoBhz1aRxcSUDk36SAEdhvxWa9P593z7wRGpj3:sDqPe1Cxcxk3ZAEUadzHF9
Score

10^/10

wannacry discovery ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Contacts a large (932) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwarespywarestealerworm