Ransomware Traffic Detected (WannaCry)

2017-05-1500:00:00

Tenable

www.tenable.com

JSON

The remote system may be affected by ransomware that encrypts most or all of the files on a user’s computer. Then, the software demands that a ransom be paid in order to have the files decrypted. This attack is related to the recent ShadowBrokers dump containing NSA weaponized software exploits.

Binary data 700099.prm

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0145

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0146

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0147

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0148

www.nessus.org/u?cd7c91b0

technet.microsoft.com/library/security/ms17-010

JSON