MalwareExploits 1 CVE

Wana Decryptor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue Windows SMBv1 Remote Code ExecutionExploited in the wild

The ransomware spread appears to leverage an SMB exploit from the April 2017 Shadow Brokers dump... eSentire highly recommends that MS17-010 patches be deployed immediately... The Microsoft SMB vulnerability is the primary means of the ransomware spreading while inside the network.

via esentire product advisoriesesentire.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Microsoft had released a patch targeting the vulnerability. But the success of the attack shows that not enough people took advantage of the patch.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

A security expert in England has been hailed as an 'accidental hero' for quashing the spread of the initial version of the ransomware late Friday... used it to stop the worm from spreading.

Lateral Movement

3 techniques

T1021.002SMB/Windows Admin SharesEvidence1

According to CCN-CERT, that flaw is MS17-010, a vulnerability in the Windows Server Message Block (SMB) service, which Windows computers rely upon to share files and printers across a local network.

T1210Exploitation of Remote ServicesEvidence3

The ransomware spread appears to leverage an SMB exploit from the April 2017 Shadow Brokers dump.

T1570Lateral Tool TransferEvidence1

The Microsoft SMB vulnerability is the primary means of the ransomware spreading while inside the network.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

The purpose of the TOR client appears to send the infected machine's encryption key to the threat actor controlling the ransomware.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

At least 16 hospitals in the United Kingdom are being forced to divert emergency patients today after computer systems there were infected with ransomware, a type of malicious software that encrypts a victim’s documents, images, music and other files unless the victim pays for a key to unlock them.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

krebs on securityNews

May 12, 2017

U.K. Hospitals Hit in Widespread Ransomware Attack - Krebs on Security

Ransomware that encrypts victim files and demands a $300 Bitcoin payment for decryption. The content says it spread rapidly across organizations and appears capable of propagating through vulnerable Windows SMB systems, persistently encrypting newly created files on infected machines.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Wana Decryptor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue Windows SMBv1 Remote Code ExecutionExploited in the wild

via esentire product advisoriesesentire.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Microsoft had released a patch targeting the vulnerability. But the success of the attack shows that not enough people took advantage of the patch.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

A security expert in England has been hailed as an 'accidental hero' for quashing the spread of the initial version of the ransomware late Friday... used it to stop the worm from spreading.

Lateral Movement

3 techniques

T1021.002SMB/Windows Admin SharesEvidence1

According to CCN-CERT, that flaw is MS17-010, a vulnerability in the Windows Server Message Block (SMB) service, which Windows computers rely upon to share files and printers across a local network.

T1210Exploitation of Remote ServicesEvidence3

The ransomware spread appears to leverage an SMB exploit from the April 2017 Shadow Brokers dump.

T1570Lateral Tool TransferEvidence1

The Microsoft SMB vulnerability is the primary means of the ransomware spreading while inside the network.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

The purpose of the TOR client appears to send the infected machine's encryption key to the threat actor controlling the ransomware.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

krebs on securityNews

May 12, 2017

U.K. Hospitals Hit in Widespread Ransomware Attack - Krebs on Security

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.