wannacry | 8fb61486f47e86e86e20c426292579a6583f13c7207354ee202880069dd8706e | Triage™

Login
Reports

Overview

overview

Static

static

3

20a4b8bb21...92.dll

windows10-2004-x64

20a4b8bb21...92.dll

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
20a4b8bb2191e6c95c01473e9d36affe2d293f1ee56839b4a64a5a21e8157a92.zip
Size 2.1MB
Sample261026-wf5h9sbf39
SHA256 8fb61486f47e86e86e20c426292579a6583f13c7207354ee202880069dd8706e
MD5 2c758d8f17936e8363a1109667bfef6d
SHA1 4a26aaab13e0604ff5d07444ed17d8a5a153ef8d
SHA512 27cc002482a2e46ac6a0b6ed54c0b10c288c889c7f964309461b18f7df4767776d588bb9638c55d762c8e9f2edd32677a34ec256ca3a9473a911d7ba4eaba7ea
SSDEEP 49152:CDdjtnl8zPic00D33z2N+1VCxfOuUhAqDlR:CDFQH3qkCfO3DT
TLSH
T179A533D650840172D31F63ADE8DAABFAC16BED2A60BF1BE58CD34247DF14385C161326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

wannacry defense_evasion discovery privilege_escalation ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

20a4b8bb2191e6c95c01473e9d36affe2d293f1ee56839b4a64a5a21e8157a92.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

14 signatures

150 seconds

defense_evasion discovery wannacry privilege_escalation ransomware worm

Behavioral task

behavioral2

Sample

20a4b8bb2191e6c95c01473e9d36affe2d293f1ee56839b4a64a5a21e8157a92.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

defense_evasion discovery wannacry privilege_escalation ransomware worm

Malware Config

Targets

- Target
  20a4b8bb2191e6c95c01473e9d36affe2d293f1ee56839b4a64a5a21e8157a92
- Size 5.0MB
- SHA256 20a4b8bb2191e6c95c01473e9d36affe2d293f1ee56839b4a64a5a21e8157a92
- MD5 8d2756432884cecd4ddefa96e73c10a1
- SHA1 bae447045b50339780ba1d100df4dab5927d58d0
- SHA512 29323be1398d3ec11fdd5f9a86f5aa8feea862b62f13dc0269579136c5b582e72eecfeaac1ccce6e95a7f84a6b82169a3fbcf5309d0ef66697387a30a9b498e0
- SSDEEP 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA
- TLSH
  T1B436F601D2E51AA0DAF25FF7267ADB10833A6E45895BA66E1221500F0C77F1CDDE6F2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery wannacry privilege_escalation ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Modifies firewall policy service
  defense_evasion
- Contacts a large (3304) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Process Injection

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Process Injection

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverywannacryprivilege_escalationransomwareworm

behavioral2

defense_evasiondiscoverywannacryprivilege_escalationransomwareworm

© 2018-2026

Terms | Privacy