MITRE ATT&CKsoftware (malware)
S0366 WannaCry
- Domain
- enterprise, ics
- Platforms
- Windows
- Aliases
- WanaCry, WanaCrypt, WanaCrypt0r, WCry
- Version
- 1.1
- Created
- 2019-03-25
Description
WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.
Related
Uses · MITRE ATT&CK (18)
- T0866 Exploitation of Remote Services technique
- T0867 Lateral Tool Transfer technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1570 Lateral Tool Transfer technique
- T1564.001 Hidden Files and Directories sub-technique
- T1563.002 RDP Hijacking sub-technique
- T1222.001 Windows Permissions sub-technique
- T1543.003 Windows Service sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1210 Exploitation of Remote Services technique
- T1016 System Network Configuration Discovery technique
- T1018 Remote System Discovery technique
- T1047 Windows Management Instrumentation technique
- T1083 File and Directory Discovery technique
- T1120 Peripheral Device Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group
References
- https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html FireEye WannaCry 2017
- https://www.secureworks.com/research/wcry-ransomware-analysis SecureWorks WannaCry Analysis
- https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4 Washington Post WannaCry 2017
- https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/ LogRhythm WannaCry
- https://www.us-cert.gov/ncas/alerts/TA17-132A US-CERT WannaCry 2017