Overview

overview

10

Static

static

dfa9f37c76...be.dll

windows7-x64

10

dfa9f37c76...be.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfa9f37c769db7c48c6442fedbc0fdbe

  • Size

    5.0MB

  • Sample

    220720-bsy7ssafbn

  • MD5

    dfa9f37c769db7c48c6442fedbc0fdbe

  • SHA1

    b95b419a55747a6b64c68f6a1e329d7cba0bb8cc

  • SHA256

    70464f96d9da53e3030e62a82bf60910b0cc042a1d679f97524d0a1296ef256b

  • SHA512

    b2ddcc3ffe8ee22ca945a3a369a2c1fda1949f236cd93be5f6af9621a88eceba88e22e3e6d6f8e1bbacc9c0c0dc0f5feaa6951a622b49d11d093c56e0ef5bb8a

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      dfa9f37c769db7c48c6442fedbc0fdbe

    • Size

      5.0MB

    • MD5

      dfa9f37c769db7c48c6442fedbc0fdbe

    • SHA1

      b95b419a55747a6b64c68f6a1e329d7cba0bb8cc

    • SHA256

      70464f96d9da53e3030e62a82bf60910b0cc042a1d679f97524d0a1296ef256b

    • SHA512

      b2ddcc3ffe8ee22ca945a3a369a2c1fda1949f236cd93be5f6af9621a88eceba88e22e3e6d6f8e1bbacc9c0c0dc0f5feaa6951a622b49d11d093c56e0ef5bb8a

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3315) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1300) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks