Overview

overview

10

Static

static

ffe5000106...db.dll

windows7-x64

10

ffe5000106...db.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffe50001067cf3ae6bf257a6342f11db

  • Size

    5.0MB

  • Sample

    220720-b742laabh5

  • MD5

    ffe50001067cf3ae6bf257a6342f11db

  • SHA1

    0a717beacabe7cc0296d11cd92f2fa19ff8fe8e7

  • SHA256

    a67a635db3b5bdd17342d78bea799f246e05336390b1c24d877f200b04e02928

  • SHA512

    1cfd1f5397e8b6d887dfea7d76579f7bb304af9ac9d8a796bc7abe118dde12b9a36db1bcf2d2fca82a58824fed81c26ea56d237895a27e054d0652f5075f4ed8

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      ffe50001067cf3ae6bf257a6342f11db

    • Size

      5.0MB

    • MD5

      ffe50001067cf3ae6bf257a6342f11db

    • SHA1

      0a717beacabe7cc0296d11cd92f2fa19ff8fe8e7

    • SHA256

      a67a635db3b5bdd17342d78bea799f246e05336390b1c24d877f200b04e02928

    • SHA512

      1cfd1f5397e8b6d887dfea7d76579f7bb304af9ac9d8a796bc7abe118dde12b9a36db1bcf2d2fca82a58824fed81c26ea56d237895a27e054d0652f5075f4ed8

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3272) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1281) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks