MalwareExploits 1 CVE

Wana Decryptor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

According to CCN-CERT, that flaw is MS17-010, a vulnerability in the Windows Server Message Block (SMB) service... That SMB flaw has enabled Wana Decryptor to spread to more than 36,000 Windows computers so far. | NHS said the investigation is at an early stage but the ransomware that hit at least 16 NHS facilities is a variant of Wana Decryptor (a.k.a. “WannaCry”), a ransomware strain that surfaced roughly two weeks ago.

via krebs on securitykrebsonsecurity.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Microsoft had released a patch targeting the vulnerability. But the success of the attack shows that not enough people took advantage of the patch.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

A security expert in England has been hailed as an 'accidental hero' for quashing the spread of the initial version of the ransomware late Friday... used it to stop the worm from spreading.

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

According to CCN-CERT, that flaw is MS17-010, a vulnerability in the Windows Server Message Block (SMB) service, which Windows computers rely upon to share files and printers across a local network.

T1210Exploitation of Remote ServicesEvidence2

there are indications the malware may be spreading to vulnerable systems through a security hole in Windows that was recently patched by Microsoft.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

At least 16 hospitals in the United Kingdom are being forced to divert emergency patients today after computer systems there were infected with ransomware, a type of malicious software that encrypts a victim’s documents, images, music and other files unless the victim pays for a key to unlock them.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

krebs on securityNews

May 12, 2017

U.K. Hospitals Hit in Widespread Ransomware Attack - Krebs on Security

Ransomware that encrypts victim files and demands a $300 Bitcoin payment for decryption. The content says it spread rapidly across organizations and appears capable of propagating through vulnerable Windows SMB systems, persistently encrypting newly created files on infected machines.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Wana Decryptor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

via krebs on securitykrebsonsecurity.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Microsoft had released a patch targeting the vulnerability. But the success of the attack shows that not enough people took advantage of the patch.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

A security expert in England has been hailed as an 'accidental hero' for quashing the spread of the initial version of the ransomware late Friday... used it to stop the worm from spreading.

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

According to CCN-CERT, that flaw is MS17-010, a vulnerability in the Windows Server Message Block (SMB) service, which Windows computers rely upon to share files and printers across a local network.

T1210Exploitation of Remote ServicesEvidence2

there are indications the malware may be spreading to vulnerable systems through a security hole in Windows that was recently patched by Microsoft.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

krebs on securityNews

May 12, 2017

U.K. Hospitals Hit in Widespread Ransomware Attack - Krebs on Security

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.