Overview

overview

10

Static

static

cd04b4d1ff...54.dll

windows7-x64

10

cd04b4d1ff...54.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd04b4d1ff7060806aa972214eff0e54

  • Size

    5.0MB

  • Sample

    220720-back3sadel

  • MD5

    cd04b4d1ff7060806aa972214eff0e54

  • SHA1

    c1137d8164f8374a6018c7c1910c0984111d3101

  • SHA256

    2557610c7a60f790051868762f9907822e52b2a40c09d3b9c8b241fe1ea28a01

  • SHA512

    931e4c930974e664f061f6ffe3743db4bde03967e9e0d124a42b84ad5ac59bffe45415e1bf278d1e68bd4a2482afd9a89d39d0dd4298facce7bca8b96db7d34c

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      cd04b4d1ff7060806aa972214eff0e54

    • Size

      5.0MB

    • MD5

      cd04b4d1ff7060806aa972214eff0e54

    • SHA1

      c1137d8164f8374a6018c7c1910c0984111d3101

    • SHA256

      2557610c7a60f790051868762f9907822e52b2a40c09d3b9c8b241fe1ea28a01

    • SHA512

      931e4c930974e664f061f6ffe3743db4bde03967e9e0d124a42b84ad5ac59bffe45415e1bf278d1e68bd4a2482afd9a89d39d0dd4298facce7bca8b96db7d34c

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3197) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1282) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks