Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation - Microsoft Security Blog
Tags
cmtmf-attack-pattern: Code Injection
attack-pattern: Data Direct Model Asynchronous Procedure Call - T1055.004 Code Injection - T1540 Exploits - T1587.004 Exploits - T1588.005 Hardware - T1592.001 Hooking - T1617 Malware - T1587.001 Malware - T1588.001 Python - T1059.006 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Hooking - T1179 Hooking
Show in Graph
Common Information
Type Value
UUID 42196233-24bc-485e-9806-47cd737a21c1
Fingerprint dbd8531888e2447
Analysis status DONE
Considered CTI value 1
Text language
Published June 30, 2017, 6 a.m.
Added to db Jan. 18, 2023, 9:19 p.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
Title Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation - Microsoft Security Blog
Detected Hints/Tags/Attributes 67/2/4
Source URLs
Redirection Url
Details Source https://blogs.technet.microsoft.com/mmpc/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation/
Details Source https://cloudblogs.microsoft.com/microsoftsecure/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation/
Details Source https://www.microsoft.com/en-us/security/blog/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation/?source=mmpc
Details Source https://www.microsoft.com/en-us/security/blog/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation?source=mmpc
Details Source https://www.microsoft.com/security/blog/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation?source=mmpc
URL Provider
Details Provider Source level domain
Details microsoft.com blogs.technet.microsoft.com
Details microsoft.com www.microsoft.com
Details microsoft.com cloudblogs.microsoft.com
Attributes
Details Type #Events CTI Value
Details CVE 35 
cve-2017-0145
Details File 10 
mssecsvc.exe
Details File 478 
lsass.exe
Details File 7 
c:\windows\mssecsvc.exe