Overview

overview

10

Static

static

44009d29b2...8b.dll

windows7-x64

10

44009d29b2...8b.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44009d29b2a5d0e57cc576f6592b638b

  • Size

    5.0MB

  • Sample

    220720-bf4azsaebm

  • MD5

    44009d29b2a5d0e57cc576f6592b638b

  • SHA1

    c76a4669f3efff22d6d5268a1e0bfe579d54454f

  • SHA256

    1e35abdf507097f8c58db2ef695b3b1f1e26145037f4793ba5f42aa84557eab0

  • SHA512

    dacbb857593d86fb005be2779e970b651c834cd138e27f3fe2969c0f403162ef4f8cd4f41e0a881737a91387d2beb7ed296c08bde0b3c64953d2da0a6425bdd2

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      44009d29b2a5d0e57cc576f6592b638b

    • Size

      5.0MB

    • MD5

      44009d29b2a5d0e57cc576f6592b638b

    • SHA1

      c76a4669f3efff22d6d5268a1e0bfe579d54454f

    • SHA256

      1e35abdf507097f8c58db2ef695b3b1f1e26145037f4793ba5f42aa84557eab0

    • SHA512

      dacbb857593d86fb005be2779e970b651c834cd138e27f3fe2969c0f403162ef4f8cd4f41e0a881737a91387d2beb7ed296c08bde0b3c64953d2da0a6425bdd2

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3201) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1305) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks