Overview

overview

10

Static

static

d1e3bb77d2...de.dll

windows7-x64

10

d1e3bb77d2...de.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1e3bb77d27f27e98a33a21d16f35dde

  • Size

    5.0MB

  • Sample

    220720-byjpasabc3

  • MD5

    d1e3bb77d27f27e98a33a21d16f35dde

  • SHA1

    a00abd82ed0a4f90c4525692f20b8f64954263d8

  • SHA256

    5ff3670dc706430739e4ab20f8777d5ac3ace433bb0783b038fe8f9aaa2af461

  • SHA512

    f7f8fdc2afc776a9fecce2cf4999afcc3a89c9ec5fc7b33e589b8286419ff5f8cf4a5f4db2c2bab60fa55ca771b72b7f4c791c31b345c7a074409c8b6e4565a8

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      d1e3bb77d27f27e98a33a21d16f35dde

    • Size

      5.0MB

    • MD5

      d1e3bb77d27f27e98a33a21d16f35dde

    • SHA1

      a00abd82ed0a4f90c4525692f20b8f64954263d8

    • SHA256

      5ff3670dc706430739e4ab20f8777d5ac3ace433bb0783b038fe8f9aaa2af461

    • SHA512

      f7f8fdc2afc776a9fecce2cf4999afcc3a89c9ec5fc7b33e589b8286419ff5f8cf4a5f4db2c2bab60fa55ca771b72b7f4c791c31b345c7a074409c8b6e4565a8

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3179) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1238) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks