Overview

overview

10

Static

static

d3df97698f...4a.dll

windows7-x64

10

d3df97698f...4a.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3df97698f6ac52964481865c72ef24a

  • Size

    5.0MB

  • Sample

    220720-beydcaadhr

  • MD5

    d3df97698f6ac52964481865c72ef24a

  • SHA1

    9a997ea429f0b6da3342b70dee614586a0dbc428

  • SHA256

    bfb00de090581b449c36d04734aaa3d62802fb1bee1d6a4c614cb0d58d1143fb

  • SHA512

    eeb26539ad9ba91206c794bd0a1b12a858d46d0c04f38545155a449797932f2697f6152057392e9c2ce0afad2998defc6ab2d169ee94f0c92f176f5c2b44680c

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      d3df97698f6ac52964481865c72ef24a

    • Size

      5.0MB

    • MD5

      d3df97698f6ac52964481865c72ef24a

    • SHA1

      9a997ea429f0b6da3342b70dee614586a0dbc428

    • SHA256

      bfb00de090581b449c36d04734aaa3d62802fb1bee1d6a4c614cb0d58d1143fb

    • SHA512

      eeb26539ad9ba91206c794bd0a1b12a858d46d0c04f38545155a449797932f2697f6152057392e9c2ce0afad2998defc6ab2d169ee94f0c92f176f5c2b44680c

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (2647) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (982) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks