世界各地で発生したランサムウェア WannaCry の感染事案についてまとめてみた

2017-05-13 piyokango A summary of ransomware WannaCry infection cases that have occurred around the world

http://d.hatena.ne.jp/Kango/20170513/1494700355

Thumbnail for 世界各地で発生したランサムウェア WannaCry の感染事案についてまとめてみた

Piyolog's WannaCry roundup tracks the May 2017 global ransomware outbreak and Japanese impact rather than a single DPRK-specific intrusion report. It links the worm's spread to MS17-010, CVE-2017-0145, and ETERNALBLUE, notes emergency Microsoft patches for unsupported Windows versions, and records reports ranging from more than 200,000 infections in at least 150 countries to multiple Japanese cases. The preserved technical section says WannaCry scanned LAN and internet hosts for vulnerable Windows machines, threatened to double the ransom after three days and delete files after seven, and listed three Bitcoin wallets with about 35.95 BTC by May 16. It also records kill-switch domains, onion C2 addresses, broad encrypted file extensions, and mitigations such as applying MS17-010 and checking for DoublePulsar.

Indicators of Compromise

Type Value First Seen Last Seen
HASH 5ad4efd90dcde01d26cc6f32f7ce3ce… 2017-05-13 2021-12-02
DOMAIN xxlvbrloxvriy2c5.onion 2017-05-12 2021-12-02
DOMAIN cwwnhwhlz52maqm7.onion 2017-05-12 2021-12-02
DOMAIN gx7ekbenv2riucmf.onion 2017-05-12 2021-12-02
DOMAIN 76jdd2ir2embyv47.onion 2017-05-12 2021-12-02
HASH 32f24601153be0885f11d62e0a8a2f0… 2017-05-13 2020-03-09
HASH 198a25e52018dce7b2f76c3b4994821… 2017-05-13 2017-05-13
HASH 7b7aa67a3d47cb39d46ed556b220a7a… 2017-05-13 2017-05-13
HASH b9318a66fa7f50f2f3ecaca02a96268… 2017-05-13 2017-05-13
URL https://misentropic.com/wannacr… 2017-05-13 2017-05-13
DOMAIN misentropic.com 2017-05-13 2017-05-13
DOMAIN rphjmrpwmfv6v2e.onion 2017-05-13 2017-05-13
DOMAIN fuji-news.net 2017-05-13 2017-05-13
DOMAIN doublepulsar.below0day.com 2017-05-13 2017-05-13
DOMAIN 57gspsprrzlojinas.onion 2017-05-13 2017-05-13
DOMAIN sqjolphimrr7jqw6.onion 2017-05-12 2017-05-13

Related Reports

« Back