Overview

overview

10

Static

static

8810123ec8...38.dll

windows7_x64

10

8810123ec8...38.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8810123ec8fabd8acb91a396572db3229971f85e788ef958022217f8a858ad38

  • Size

    5.0MB

  • Sample

    210515-vqjx23b39e

  • MD5

    8d7129d1ad154ae0f261b44b37b6ca01

  • SHA1

    6e6a12140fb66cd4dc21fe2fbcef6bb916796d97

  • SHA256

    8810123ec8fabd8acb91a396572db3229971f85e788ef958022217f8a858ad38

  • SHA512

    c7fe58ea40f9934762665c3221ce186964c4be877d05ade49ca9c7a8380c09487de859f71976f8b826f9f68a635bec1a9e8dc8f8069fc980d0df091e4f2d9145

Score
10/10
wannacryevasionransomwareworm

Malware Config

Targets

    • Target

      8810123ec8fabd8acb91a396572db3229971f85e788ef958022217f8a858ad38

    • Size

      5.0MB

    • MD5

      8d7129d1ad154ae0f261b44b37b6ca01

    • SHA1

      6e6a12140fb66cd4dc21fe2fbcef6bb916796d97

    • SHA256

      8810123ec8fabd8acb91a396572db3229971f85e788ef958022217f8a858ad38

    • SHA512

      c7fe58ea40f9934762665c3221ce186964c4be877d05ade49ca9c7a8380c09487de859f71976f8b826f9f68a635bec1a9e8dc8f8069fc980d0df091e4f2d9145

    Score
    10/10
    wannacryransomwarewormevasion

    • Modifies firewall policy service

      evasion

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks