Skip to content

DRAGNET attribution assessment: wannacry_like

Assessment: LAZARUS_SIM with HIGH confidence

Hypotheses

Hypothesis Support TTP sim Contradiction Score P (normalised)
LAZARUS_SIM 0.99 0.66 0.00 0.99 0.99
UNKNOWN 0.01 0.00 0.00 0.01 0.01
FALSE_FLAG 0.00 0.00 0.00 0.00 0.00

ACH matrix (C=consistent, I=inconsistent, N=neutral)

Signal LAZARUS_SIM FALSE_FLAG UNKNOWN
domain:killswitch-sim.example C N N
ttp:T1486 C N N
ttp:T1210 C N N
victimology:healthcare N N C
file_hash:0000000000000000000000000000000000000000000000000000000000000001 N N C
imphash:aa11aa11aa11aa11aa11aa11aa11aa11 C N N
code_reuse:fn:rc4_variant_0x3f C N N
family:WannaSim C N N

Weights

Effective weight of a signal = kind weight x specificity (1 / number of actors it links to); ttp_profile scales the IDF-cosine tradecraft term. Override with --weight kind=value.

kind weight default
code_reuse 0.75 0.75
domain 0.60 0.60
family 0.50 0.50
file_hash 0.90 0.90
imphash 0.60 0.60
ip 0.55 0.55
language 0.15 0.15
mutex 0.40 0.40
rich_header 0.35 0.35
tlsh 0.55 0.55
tool 0.30 0.30
ttp 0.15 0.15
ttp_profile 0.60 0.60
victimology 0.10 0.10
  • EV-F-001 -> domain:killswitch-sim.example -> C-LZ-2017-RANSOM
  • EV-M-001 -> imphash:aa11aa11aa11aa11aa11aa11aa11aa11 -> C-LZ-2017-RANSOM
  • EV-M-001 -> code_reuse:fn:rc4_variant_0x3f -> C-LZ-2016-BANK
  • EV-M-001 -> code_reuse:fn:rc4_variant_0x3f -> C-LZ-2017-RANSOM
  • EV-M-001 -> family:WannaSim -> C-LZ-2017-RANSOM

False-flag indicators

  • none detected

What would raise confidence

  • Independent infrastructure overlap (C2 IP/domain) with a known campaign
  • Code-reuse match in non-trivial, non-public functions
  • Corroboration from an independent reporting source

What would lower confidence

  • Shared infrastructure turns out to be public/shared hosting (CDN, VPS pool)
  • Shared code is shown to be publicly leaked or open-source
  • Hard evidence linking to a different actor

Chain of custody

seq action item sha256 entry_hash
0 ingest EV-F-001 7f13940885b7a831... 36e86e51cffefda6...
1 ingest EV-M-001 43aca9033906547f... 64513f1d69a3af93...
2 assess wannacry_like b3157d476804ea03... d90c0f17a9b83cb5...

Attribution is an analytic judgment, not proof. This assessment was generated by a transparent rule-based engine and must be reviewed by a qualified analyst before any action is taken.