Overview

overview

10

Static

static

801a67eefc...e0.dll

windows7-x64

10

801a67eefc...e0.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    801a67eefc54d40e7121fcbc1964d5e0

  • Size

    5.0MB

  • Sample

    220720-a8my2ahhd5

  • MD5

    801a67eefc54d40e7121fcbc1964d5e0

  • SHA1

    638c806612be04e37f1bad9e38f06617591487f2

  • SHA256

    0170bf3275737a4add8db50eb72834c29add03c558225376a79731d06370f2ae

  • SHA512

    82755ece6b560fa0451b7940e9fa436b42063446058c05664ae1ae8de484755376646559039617f2d92d81bec9e2b363c7721c2a0b2b59b9070810b23eaffc45

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      801a67eefc54d40e7121fcbc1964d5e0

    • Size

      5.0MB

    • MD5

      801a67eefc54d40e7121fcbc1964d5e0

    • SHA1

      638c806612be04e37f1bad9e38f06617591487f2

    • SHA256

      0170bf3275737a4add8db50eb72834c29add03c558225376a79731d06370f2ae

    • SHA512

      82755ece6b560fa0451b7940e9fa436b42063446058c05664ae1ae8de484755376646559039617f2d92d81bec9e2b363c7721c2a0b2b59b9070810b23eaffc45

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3076) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1262) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks