Overview

overview

10

Static

static

478033d0e7...68.dll

windows7-x64

10

478033d0e7...68.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    478033d0e731cd4fd9b97a62638cec68

  • Size

    5.0MB

  • Sample

    220720-a73yvsaddk

  • MD5

    478033d0e731cd4fd9b97a62638cec68

  • SHA1

    4f0ec0faced863f1a8b2ab962cdc783a44811180

  • SHA256

    9be0c27397dfe207ed6046519e6d06746d4b0faa8a7e325e72a0946ee1c820e7

  • SHA512

    ed544efdfe28a84a033d13ed2f3f57b0d1974d1f00179063c6ca31be281b8a4d0f229a52eb4dc2cb6d4440803b44caae2020c64aa79993489085b5805c469f3b

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      478033d0e731cd4fd9b97a62638cec68

    • Size

      5.0MB

    • MD5

      478033d0e731cd4fd9b97a62638cec68

    • SHA1

      4f0ec0faced863f1a8b2ab962cdc783a44811180

    • SHA256

      9be0c27397dfe207ed6046519e6d06746d4b0faa8a7e325e72a0946ee1c820e7

    • SHA512

      ed544efdfe28a84a033d13ed2f3f57b0d1974d1f00179063c6ca31be281b8a4d0f229a52eb4dc2cb6d4440803b44caae2020c64aa79993489085b5805c469f3b

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3172) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1233) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks