Overview

overview

10

Static

static

3a59009de2...80.dll

windows7_x64

10

3a59009de2...80.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a59009de26947cb34fec25f48fd2b604325036dddf76e6808cd12040a4b4280

  • Size

    5.0MB

  • Sample

    220625-gecpjaade4

  • MD5

    dbb507fba28d3fbaa5baa312e408b636

  • SHA1

    2621905b73cab4a4076532543b53dd8d534ceefa

  • SHA256

    3a59009de26947cb34fec25f48fd2b604325036dddf76e6808cd12040a4b4280

  • SHA512

    27be96638ef8758ac3ac18f686e99ccebfa492a26a02c3de95e0d0718e400dd4760a0395f19e31ecb2f034d43035b2193be2da2ff22b570316f252f4fdaead03

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      3a59009de26947cb34fec25f48fd2b604325036dddf76e6808cd12040a4b4280

    • Size

      5.0MB

    • MD5

      dbb507fba28d3fbaa5baa312e408b636

    • SHA1

      2621905b73cab4a4076532543b53dd8d534ceefa

    • SHA256

      3a59009de26947cb34fec25f48fd2b604325036dddf76e6808cd12040a4b4280

    • SHA512

      27be96638ef8758ac3ac18f686e99ccebfa492a26a02c3de95e0d0718e400dd4760a0395f19e31ecb2f034d43035b2193be2da2ff22b570316f252f4fdaead03

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (1113) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1710) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks