Overview

overview

10

Static

static

e0ca3d509c...f8.dll

windows7-x64

10

e0ca3d509c...f8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0ca3d509c7caf4f28c094c447e929f8

  • Size

    5.0MB

  • Sample

    220720-b1vjksafhl

  • MD5

    e0ca3d509c7caf4f28c094c447e929f8

  • SHA1

    364f26073103965c3c0fecf897e23e0b1c95dcfd

  • SHA256

    808c1ca5e82fde0f9462c8ac8dd1119bb929ca8a249dbc30dc7e9ee3119e2270

  • SHA512

    fba924ca55c06511c2623f338071345371858ea83064fd11e9bb8999409a072384f5f9e9f02d00cd44c806e98979b8a2d2dc03660f494bd3d61a8f49c2f3afcf

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      e0ca3d509c7caf4f28c094c447e929f8

    • Size

      5.0MB

    • MD5

      e0ca3d509c7caf4f28c094c447e929f8

    • SHA1

      364f26073103965c3c0fecf897e23e0b1c95dcfd

    • SHA256

      808c1ca5e82fde0f9462c8ac8dd1119bb929ca8a249dbc30dc7e9ee3119e2270

    • SHA512

      fba924ca55c06511c2623f338071345371858ea83064fd11e9bb8999409a072384f5f9e9f02d00cd44c806e98979b8a2d2dc03660f494bd3d61a8f49c2f3afcf

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3271) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1232) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks