General
-
Target
WannaCry2
-
Size
5.0MB
-
Sample
220711-k45y6aaah4
-
MD5
3e142c642b1d1e6a01ae319ccbe487a3
-
SHA1
5653bf6e1613bfab68d6d05111b312ed0dceb448
-
SHA256
6f282c0df25a61bef8bd83b317d7c9493b575717b691e30d63da8cb5ec898e7b
-
SHA512
e1215c551e96f2f6e3b5266ef845853fb11e3699ae554bbbec51a8e4c6c91763df1242290dc167b129e96aa33665edd5d3d350d59479c1060f1837052e811640
Static task
static1
Behavioral task
behavioral1
Sample
WannaCry2.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
WannaCry2.dll
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
WannaCry2
-
Size
5.0MB
-
MD5
3e142c642b1d1e6a01ae319ccbe487a3
-
SHA1
5653bf6e1613bfab68d6d05111b312ed0dceb448
-
SHA256
6f282c0df25a61bef8bd83b317d7c9493b575717b691e30d63da8cb5ec898e7b
-
SHA512
e1215c551e96f2f6e3b5266ef845853fb11e3699ae554bbbec51a8e4c6c91763df1242290dc167b129e96aa33665edd5d3d350d59479c1060f1837052e811640
Score10/10-
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
-
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
-
Contacts a large (3122) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Contacts a large (1275) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory
-