aol.pm

WannaCry

Software · ATTACK:enterprise:S0366

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0366",
  "title": "WannaCry",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0366",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
  "external_id": "S0366",
  "domain": "enterprise",
  "created": "2019-03-25T17:30:17.004Z",
  "modified": "2024-12-09T02:29:13.859Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "WanaCrypt0r"
    },
    {
      "source_name": "WCry"
    },
    {
      "source_name": "WanaCry"
    },
    {
      "source_name": "WanaCrypt"
    },
    {
      "source_name": "FireEye WannaCry 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
    },
    {
      "source_name": "SecureWorks WannaCry Analysis",
      "url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
    },
    {
      "source_name": "Washington Post WannaCry 2017",
      "url": "https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4"
    },
    {
      "source_name": "LogRhythm WannaCry",
      "url": "https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"
    },
    {
      "source_name": "US-CERT WannaCry 2017",
      "url": "https://www.us-cert.gov/ncas/alerts/TA17-132A"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e12dc13-6f73-4ad9-9cb5-845d443b4d58

FireEye WannaCry 2017 · LogRhythm WannaCry · US-CERT WannaCry 2017

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1427027f-0fd1-4781-b4b3-06dc8e6e9998

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0366

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25e7ca82-2784-433a-90a9-a3483615a655

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · FireEye APT38 Oct 2018 · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca496bf-41f9-4d0b-b36d-576f90db340e

FireEye WannaCry 2017 · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f58682a-dc04-40f6-b224-42bab6ef6f67

FireEye WannaCry 2017

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c56206f-8ae3-4296-ab89-bc2036b74896

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ad5d5c8-b53e-417c-a574-3818269d1e85

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1563.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b22c256-44a9-4b73-8df6-e4da9c32a5a3

LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76d0be57-e439-4640-b26d-db422353d9e5

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a116d1c-33ab-4729-abff-2e37dc387f31

SecureWorks WannaCry Analysis

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a802b910-b023-425a-8c09-c1b2df185812

LogRhythm WannaCry · Checkpoint WannaCry 2017

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3c7d447-9b00-4bd6-b0b7-25c0bb56d28a

SecureWorks WannaCry Analysis

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1222.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c49a3d89-c8fa-4c5d-813e-f4495d892d1a

LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf498579-a7c9-4d06-949b-fb75bf762990

SecureWorks WannaCry Analysis

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9bfa498-69a1-44f9-8e44-67a6a4c48088

SecureWorks WannaCry Analysis

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--facd3eca-9156-47a8-85d1-09719bc0eb88

FireEye WannaCry 2017 · LogRhythm WannaCry

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe78de3a-107f-4870-b5a1-c60289d68dec

LogRhythm WannaCry

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.