Overview

overview

10

Static

static

3ca20938c6...3d.dll

windows7_x64

10

3ca20938c6...3d.dll

windows10-2004_x64

10

Resubmissions

03-07-2022 05:49

220703-gh9hnshccn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ca20938c652880a62726152cf45b0fb46a7cf85da69c979d17176cdd1669c3d

  • Size

    5.0MB

  • Sample

    220703-gh9hnshccn

  • MD5

    1bb736b97b5bcb4c5b3adf5c3c903fa3

  • SHA1

    10f9c2033d3ff3618ca7253f7b68a09bbd681c4c

  • SHA256

    3ca20938c652880a62726152cf45b0fb46a7cf85da69c979d17176cdd1669c3d

  • SHA512

    9036eb430ec907311b90f623aab08a17b27e2238c3a8745e5436837d57f34156ff81efa87abe8770e9a87444c62934f8979d66ef42c2b67c9d02c22f50c02285

Score
10/10
wannacrydiscoveryransomwaresuricataworm

Malware Config

Targets

    • Target

      3ca20938c652880a62726152cf45b0fb46a7cf85da69c979d17176cdd1669c3d

    • Size

      5.0MB

    • MD5

      1bb736b97b5bcb4c5b3adf5c3c903fa3

    • SHA1

      10f9c2033d3ff3618ca7253f7b68a09bbd681c4c

    • SHA256

      3ca20938c652880a62726152cf45b0fb46a7cf85da69c979d17176cdd1669c3d

    • SHA512

      9036eb430ec907311b90f623aab08a17b27e2238c3a8745e5436837d57f34156ff81efa87abe8770e9a87444c62934f8979d66ef42c2b67c9d02c22f50c02285

    Score
    10/10
    wannacrydiscoveryransomwaresuricataworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata

    • suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata

    • Contacts a large (3220) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1276) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

3
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks