Overview

overview

10

Static

static

276c1f2820...5c.dll

windows7_x64

10

276c1f2820...5c.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    276c1f2820466b60541694851bd5546b5c109e04fa6c99822f2649d89f970b5c

  • Size

    5.0MB

  • Sample

    220616-fjmjvsehg5

  • MD5

    cb99dbcc738243976831a1a5af249010

  • SHA1

    11b3de1c41e9d87610011145d0f81eeb5c44a8ca

  • SHA256

    276c1f2820466b60541694851bd5546b5c109e04fa6c99822f2649d89f970b5c

  • SHA512

    3a24cb1d1fcf846efa62c458eabef31368a5fab5470ba3902e7e377524607a250be5aa0ecd1d46f08cb3754344edb87d4185e9c0cf9a2d0282b40b18effe447e

Score
10/10
wannacrydiscoveryransomwaresuricataworm

Malware Config

Targets

    • Target

      276c1f2820466b60541694851bd5546b5c109e04fa6c99822f2649d89f970b5c

    • Size

      5.0MB

    • MD5

      cb99dbcc738243976831a1a5af249010

    • SHA1

      11b3de1c41e9d87610011145d0f81eeb5c44a8ca

    • SHA256

      276c1f2820466b60541694851bd5546b5c109e04fa6c99822f2649d89f970b5c

    • SHA512

      3a24cb1d1fcf846efa62c458eabef31368a5fab5470ba3902e7e377524607a250be5aa0ecd1d46f08cb3754344edb87d4185e9c0cf9a2d0282b40b18effe447e

    Score
    10/10
    wannacryransomwaresuricatawormdiscovery

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata

    • suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata

    • Contacts a large (3257) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks