Overview

overview

10

Static

static

ffafe05991...b9.dll

windows7-x64

10

ffafe05991...b9.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffafe05991d988d69f994b0b863b32b9

  • Size

    5.0MB

  • Sample

    220720-bzpa6sabd2

  • MD5

    ffafe05991d988d69f994b0b863b32b9

  • SHA1

    d9a49bbf1f071a7b68883d4b8389219c71508ce7

  • SHA256

    3171e1fe25a2035dbd8233e852296c92c3651b5fcfc98ce1308ac6a2eed2cda1

  • SHA512

    9f7536d14e1f0a5d531bfbf19d4eeb5235067d4a5c2a5e09b384c3daf4beb1f6416eb267bc7c2d10015abb2c087fb373108261c0fd21421ab4367cfcfbca70c5

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      ffafe05991d988d69f994b0b863b32b9

    • Size

      5.0MB

    • MD5

      ffafe05991d988d69f994b0b863b32b9

    • SHA1

      d9a49bbf1f071a7b68883d4b8389219c71508ce7

    • SHA256

      3171e1fe25a2035dbd8233e852296c92c3651b5fcfc98ce1308ac6a2eed2cda1

    • SHA512

      9f7536d14e1f0a5d531bfbf19d4eeb5235067d4a5c2a5e09b384c3daf4beb1f6416eb267bc7c2d10015abb2c087fb373108261c0fd21421ab4367cfcfbca70c5

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3129) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1246) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks