wannacry | 251695b02c34ccc525a71b0a694535d037b00ddb2a421776e22e192fa8a3c52a

General

Target
251695b02c34ccc525a71b0a694535d037b00ddb2a421776e22e192fa8a3c52a
Size 4.0MB
Sample260728-p5e7caxbma
SHA256 251695b02c34ccc525a71b0a694535d037b00ddb2a421776e22e192fa8a3c52a
MD5 d4ab7120d38cb5f3c3879c427fa083f1
SHA1 08ec268a0eeda6af7c5fd2ebe6b609b2e6f4bbe7
SHA512 f12a5e02dca38efe3aea35688b3aea1293123049e1681e001f0566a475677e0f71f3cfe61c29033a8af79f123d1f2359f5146bd22cf01c3f49ee4b85878d3b6a
SSDEEP 98304:HxesTjt72blySUnMlgQasVBjpxesTjt72blySUnMlgQasVBjc:RZ7Gly5Ml/asDZ7Gly5Ml/asc
TLSH
T1451633BC70B65DBCE3152EDC086FC4D7A55634667ADB29029F4008AB689AF3FD7808D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  quarantine/antiav/mssecsvr.exe
- Size 2.2MB
- SHA256 458d19c4e0d41353ade3b5eb94815436ac911ad13c2fa525f753d5ef182f417f
- MD5 142db3228dd9177f5fdaec26d0f0e19a
- SHA1 f4f080d897a4fe16aa557a3499a7d495db62148b
- SHA512 07a24755cc8e53669065d3dcfaee9ff6670670242b4e7f5ddd82f75501923372a394063f3b6a9fcd27cf67eb84a152e3b7b7c7d0327d22e2591fb47dec9053cf
- SSDEEP 49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QpyfBhz1aRxcSUDk36SAEdhvn
- TLSH
  T117B5236530A8C0B4D103147444ABCB62F6B67C3A17BA694FBF904E7E2E63B56E711B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery wannacry ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2760) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2
- Target
  quarantine/mssecsvr.exe
- Size 2.2MB
- SHA256 458d19c4e0d41353ade3b5eb94815436ac911ad13c2fa525f753d5ef182f417f
- MD5 142db3228dd9177f5fdaec26d0f0e19a
- SHA1 f4f080d897a4fe16aa557a3499a7d495db62148b
- SHA512 07a24755cc8e53669065d3dcfaee9ff6670670242b4e7f5ddd82f75501923372a394063f3b6a9fcd27cf67eb84a152e3b7b7c7d0327d22e2591fb47dec9053cf
- SSDEEP 49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QpyfBhz1aRxcSUDk36SAEdhvn
- TLSH
  T117B5236530A8C0B4D103147444ABCB62F6B67C3A17BA694FBF904E7E2E63B56E711B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery wannacry ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2765) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Wannacry

Contacts a large (2760) amount of remote hosts

Executes dropped EXE

Creates a large amount of network flows

Family: Wannacry

Contacts a large (2765) amount of remote hosts

Executes dropped EXE

Creates a large amount of network flows

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4