Overview

overview

10

Static

static

a37575f6c0...bf.dll

windows7-x64

10

a37575f6c0...bf.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a37575f6c05279836ea85b8b4a3bd9bf

  • Size

    5.0MB

  • Sample

    220720-bl84esaefn

  • MD5

    a37575f6c05279836ea85b8b4a3bd9bf

  • SHA1

    cc9df61a7a5b1793bd1df43b97fb3227f0efac5d

  • SHA256

    f72d753cc258c7db1afff98235715b9b0824550009dc63090593ce078793ee84

  • SHA512

    64a3e3077fc7112c3d04deb876bcf22291be1f3f5bb0fd2a3bc1c359acf73460944fe7762cc1013527ed02b3613d607cbb681eeb6b417bf7d306d2602c867257

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      a37575f6c05279836ea85b8b4a3bd9bf

    • Size

      5.0MB

    • MD5

      a37575f6c05279836ea85b8b4a3bd9bf

    • SHA1

      cc9df61a7a5b1793bd1df43b97fb3227f0efac5d

    • SHA256

      f72d753cc258c7db1afff98235715b9b0824550009dc63090593ce078793ee84

    • SHA512

      64a3e3077fc7112c3d04deb876bcf22291be1f3f5bb0fd2a3bc1c359acf73460944fe7762cc1013527ed02b3613d607cbb681eeb6b417bf7d306d2602c867257

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3276) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1278) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

3
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks