Overview

overview

10

Static

static

1ee069455e...2c.dll

windows7-x64

10

1ee069455e...2c.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ee069455ec3b2de5eaefe54a536962c

  • Size

    5.0MB

  • Sample

    220720-bq8y8aaaf8

  • MD5

    1ee069455ec3b2de5eaefe54a536962c

  • SHA1

    6b3e9bd6122e40ee69d3bd441213fc1505c0d419

  • SHA256

    bf9b8a89148553fa0da5d2270bf7db0b5482df6517867410fead18192d5135a1

  • SHA512

    f021b5820e4a89608e87e1ce050fe2fa28b7930492bdb7823389e590f94988c967849abc6615a8c66c337a3f31df9a8bfddee6bf9e43ff497f93c57ec5cef6b9

Score
10/10
wannacrydiscoveryevasionransomwareworm

Malware Config

Targets

    • Target

      1ee069455ec3b2de5eaefe54a536962c

    • Size

      5.0MB

    • MD5

      1ee069455ec3b2de5eaefe54a536962c

    • SHA1

      6b3e9bd6122e40ee69d3bd441213fc1505c0d419

    • SHA256

      bf9b8a89148553fa0da5d2270bf7db0b5482df6517867410fead18192d5135a1

    • SHA512

      f021b5820e4a89608e87e1ce050fe2fa28b7930492bdb7823389e590f94988c967849abc6615a8c66c337a3f31df9a8bfddee6bf9e43ff497f93c57ec5cef6b9

    Score
    10/10
    wannacrydiscoveryransomwarewormevasion

    • Modifies firewall policy service

      evasion

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3247) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1266) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks