Analyzing the Wannacry Ransomware
Tags
cmtmf-attack-pattern: Process Injection
attack-pattern: Data Dns Server - T1583.002 Dns Server - T1584.002 Hardware - T1592.001 Malware - T1587.001 Malware - T1588.001 Native Api - T1575 Process Injection - T1631 Server - T1583.004 Server - T1584.004 Vulnerabilities - T1588.006 Deobfuscate/Decode Files Or Information - T1140 Execution Through Api - T1106 Obfuscated Files Or Information - T1027 Process Injection - T1055 Sudo - T1169 User Execution - T1204 User Execution
Show in Graph
Common Information
Type Value
UUID 2621c93c-c063-4b4d-bbfc-e09318dfe9ae
Fingerprint 3472d82ab4b326d1
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 26, 2024, 10:39 p.m.
Added to db Oct. 27, 2024, 1 a.m.
Last updated Nov. 17, 2024, 7:44 p.m.
Headline Analyzing the Wannacry Ransomware
Title Analyzing the Wannacry Ransomware
Detected Hints/Tags/Attributes 70/2/21
Source URLs
Redirection Url
Details Source https://medium.com/@chinazaObidike/malware-analysis-e6c67ad0bc60?source=rss------malware-5
URL Provider
Details Provider Source level domain
Details medium.com medium.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 171 ✔ Malware on Medium https://medium.com/feed/tag/malware 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 4127 
github.com
Details Domain 67 
microsoft.windows
Details File 748 
kernel32.dll
Details File 291 
user32.dll
Details File 229 
advapi32.dll
Details File 130 
ws2_32.dll
Details File 83 
crypt32.dll
Details File 4 
wannacry.exe
Details File 45 
mpr.dll
Details File 6 
msvcp60.dll
Details File 12 
rsaenh.dll
Details File 59 
netapi32.dll
Details Github username 1 
da2dalus
Details sha256 4 
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
Details IPv4 25 
6.0.0.0
Details IPv4 15 
10.0.0.3
Details MITRE ATT&CK Techniques 440 
T1055
Details MITRE ATT&CK Techniques 239 
T1106
Details MITRE ATT&CK Techniques 627 
T1027
Details Url 1 
https://github.com/da2dalus/the-malware-repo
Details Windows Registry Key 8 
HKLM\System\CurrentControlSet\Services