General

  • Target

    97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72

  • Size

    5.0MB

  • Sample

    220625-fwc6yshfg8

  • MD5

    1268458a18c26e706de45533e36221a4

  • SHA1

    dcb8138eb87be9fd2bf7b5e6cf90d084408c49c2

  • SHA256

    97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72

  • SHA512

    6ededc34a7b3c16c6ab116456de97adc88052f608fd9927019db47467a0935c0032935a1659ec754d7f0a4abdaae0b4d013cc12e8f99515365bfefc7e5305275

Malware Config

Targets

    • Target

      97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72

    • Size

      5.0MB

    • MD5

      1268458a18c26e706de45533e36221a4

    • SHA1

      dcb8138eb87be9fd2bf7b5e6cf90d084408c49c2

    • SHA256

      97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72

    • SHA512

      6ededc34a7b3c16c6ab116456de97adc88052f608fd9927019db47467a0935c0032935a1659ec754d7f0a4abdaae0b4d013cc12e8f99515365bfefc7e5305275

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

    • suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

    • Contacts a large (2040) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1017) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Network Service Scanning

2
T1046

Tasks