wannacry | 1f16f1c7bc3d0188261dc265e634d0e9f5aeff209d6d6a94e7f4e218e6270c68 | Triage™

Login
Reports

Overview

overview

Static

static

3

c82e1590e9...c9.dll

windows10-2004-x64

c82e1590e9...c9.dll

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
c82e1590e9059497aca0eb8e4478de1e71230bdbeb3b10df020ae9ec81de60c9.zip
Size 3.5MB
Sample261027-c8jmqaaz3p
SHA256 1f16f1c7bc3d0188261dc265e634d0e9f5aeff209d6d6a94e7f4e218e6270c68
MD5 f7725f08e8acf652b9671fc7263af8bc
SHA1 9929e613e69956d622affaf11bacd17de9b0c46e
SHA512 2ae137d44d1b74be9278c16f0c13d317ab4948c93790926d29d84b88b819fc4aff4764e011232a90c9fed425d65a7214c555f266f9d89fe022ec9e505471a446
SSDEEP 98304:/BceNeN1cfqVyfniOerSuUGiJn091cnCE+QmdOSad51+S6OLVP48aGkIBc5C6:IbcSVyfUr0Gy0bcCE+Qmyp16ITxkIBcd
TLSH
T192F533F247428D8939EF0870DFCD72A9222F25E7549B51F3BA36820DE7556ABC8D210D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

wannacry defense_evasion discovery privilege_escalation ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c82e1590e9059497aca0eb8e4478de1e71230bdbeb3b10df020ae9ec81de60c9.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

14 signatures

150 seconds

defense_evasion discovery wannacry privilege_escalation ransomware worm

Behavioral task

behavioral2

Sample

c82e1590e9059497aca0eb8e4478de1e71230bdbeb3b10df020ae9ec81de60c9.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

defense_evasion discovery wannacry privilege_escalation ransomware worm

Malware Config

Targets

- Target
  c82e1590e9059497aca0eb8e4478de1e71230bdbeb3b10df020ae9ec81de60c9
- Size 5.0MB
- SHA256 c82e1590e9059497aca0eb8e4478de1e71230bdbeb3b10df020ae9ec81de60c9
- MD5 a91a9cce626951ffdb03529631e78d4d
- SHA1 396dd25eb63ccabb5fd0a4093843bb35d4417b5f
- SHA512 029e342b0b005cbfdb5b606df65e42d7ac9b8cd66eb49f53fba2a9f0f71e75d2ca42779667a18cae63882d4602c391a8381b7181c073fd5c48314fc58986cbee
- SSDEEP 98304:bDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:bDqPe1Cxcxk3ZAEUadzR8yc4
- TLSH
  T18F363394A26CB1FCF1440EF444638927B7B73C65A7BA5E1F8BC086A60D43B5BAFD0641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery wannacry privilege_escalation ransomware worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Modifies firewall policy service
  defense_evasion
- Contacts a large (3284) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Process Injection

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Process Injection

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverywannacryprivilege_escalationransomwareworm

behavioral2

defense_evasiondiscoverywannacryprivilege_escalationransomwareworm

© 2018-2026

Terms | Privacy