Overview

overview

10

Static

static

4cc25b97bb...1f.dll

windows7-x64

10

4cc25b97bb...1f.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4cc25b97bb799e0c360bead0b3691b1f

  • Size

    5.0MB

  • Sample

    220720-by5lrsaffq

  • MD5

    4cc25b97bb799e0c360bead0b3691b1f

  • SHA1

    c731f3dd7dce8fd91b43222da11ec89241fcc804

  • SHA256

    b449d6bc93e72b048050ac5ba066eaec553512b56c1f4873e53fa70660b85d96

  • SHA512

    a34c49780f39a86dd7e1dc4532517d415a64d090e46912052df88fcf9365f095cffed343e4e9c84a2fa4c6333abfde208492fd0e5292a524a1e5a9425d599c90

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      4cc25b97bb799e0c360bead0b3691b1f

    • Size

      5.0MB

    • MD5

      4cc25b97bb799e0c360bead0b3691b1f

    • SHA1

      c731f3dd7dce8fd91b43222da11ec89241fcc804

    • SHA256

      b449d6bc93e72b048050ac5ba066eaec553512b56c1f4873e53fa70660b85d96

    • SHA512

      a34c49780f39a86dd7e1dc4532517d415a64d090e46912052df88fcf9365f095cffed343e4e9c84a2fa4c6333abfde208492fd0e5292a524a1e5a9425d599c90

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3333) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1019) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks