Overview

overview

10

Static

static

5c1a36ed59...69.dll

windows7-x64

10

5c1a36ed59...69.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c1a36ed5985d4ffc89e336964bbf269

  • Size

    5.0MB

  • Sample

    220720-a474eahha8

  • MD5

    5c1a36ed5985d4ffc89e336964bbf269

  • SHA1

    49b6b44ce62ee79808137b0125d95e8f745f2e07

  • SHA256

    c1311ce03beb66c468b2478c728706a5a24ce90452bce5b489be8753cbb25dd1

  • SHA512

    fcac4679dd4ef848ca1054ffcfe9fe2fd4c9537b4046294dafcfa524ecbc6b318f6e93e72faec9ed04c6f933005eb2c5a06022fe7db0f1fafa3d0d0d4fe023bd

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      5c1a36ed5985d4ffc89e336964bbf269

    • Size

      5.0MB

    • MD5

      5c1a36ed5985d4ffc89e336964bbf269

    • SHA1

      49b6b44ce62ee79808137b0125d95e8f745f2e07

    • SHA256

      c1311ce03beb66c468b2478c728706a5a24ce90452bce5b489be8753cbb25dd1

    • SHA512

      fcac4679dd4ef848ca1054ffcfe9fe2fd4c9537b4046294dafcfa524ecbc6b318f6e93e72faec9ed04c6f933005eb2c5a06022fe7db0f1fafa3d0d0d4fe023bd

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3222) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1251) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks