General

  • Target

    2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515

  • Size

    5.0MB

  • Sample

    220614-zn7v5sgfh7

  • MD5

    e2fec3f5f8b0a02c8be11d256129e58c

  • SHA1

    b0425805b0fd4218606b981e3617cc9c8fdce127

  • SHA256

    2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515

  • SHA512

    9075a119e9ba4c3f70589250a9ab05980607274908dd9aedb1ef2a06aafe0150cf9bfbb4218299edd505579da7820c349b12f77f2d7bdc511f5a2fac733b2073

Malware Config

Targets

    • Target

      2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515

    • Size

      5.0MB

    • MD5

      e2fec3f5f8b0a02c8be11d256129e58c

    • SHA1

      b0425805b0fd4218606b981e3617cc9c8fdce127

    • SHA256

      2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515

    • SHA512

      9075a119e9ba4c3f70589250a9ab05980607274908dd9aedb1ef2a06aafe0150cf9bfbb4218299edd505579da7820c349b12f77f2d7bdc511f5a2fac733b2073

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

    • suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

    • Contacts a large (1293) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks