Overview

overview

10

Static

static

adc8f2156c...67.dll

windows7-x64

10

adc8f2156c...67.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adc8f2156c4945882116b8516359cc67

  • Size

    5.0MB

  • Sample

    220720-bkh6lsaab7

  • MD5

    adc8f2156c4945882116b8516359cc67

  • SHA1

    ba6e3dd3516b3d8a6742879fb7e86e6218a0cfcb

  • SHA256

    f2296230172c19e908b726e85bd9ac069f0b786718a28e066482dae2261ef5c2

  • SHA512

    a1530ab0cbc5ace2c7c870d461f7f23208d49af5ad47b483a9d0cf0a5fb2f36b99b7ddec42f8268a0b9505428b328c78c653665c304a30864d2c1e34c431599e

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      adc8f2156c4945882116b8516359cc67

    • Size

      5.0MB

    • MD5

      adc8f2156c4945882116b8516359cc67

    • SHA1

      ba6e3dd3516b3d8a6742879fb7e86e6218a0cfcb

    • SHA256

      f2296230172c19e908b726e85bd9ac069f0b786718a28e066482dae2261ef5c2

    • SHA512

      a1530ab0cbc5ace2c7c870d461f7f23208d49af5ad47b483a9d0cf0a5fb2f36b99b7ddec42f8268a0b9505428b328c78c653665c304a30864d2c1e34c431599e

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3102) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1252) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks