Overview

overview

10

Static

static

d8b98dc9e3...c3.dll

windows7-x64

10

d8b98dc9e3...c3.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8b98dc9e3c6dab04b2abb1224335ac3

  • Size

    5.0MB

  • Sample

    220720-ce1ddaahar

  • MD5

    d8b98dc9e3c6dab04b2abb1224335ac3

  • SHA1

    9528b4df7d60103b82edf207ba6533b641d8b354

  • SHA256

    932e30b225064e714d489eb2dc8b9fabc78f6f18858afdc34cb55174b128b013

  • SHA512

    28f8669c8ad1b805f4ff5bed7564a4353f160bae8c7b3b2924cebf91073aefa1a4c2ea7e8bb7282b14dd7572e0f596675885611d97cbf420ff30cdc2855c9fce

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      d8b98dc9e3c6dab04b2abb1224335ac3

    • Size

      5.0MB

    • MD5

      d8b98dc9e3c6dab04b2abb1224335ac3

    • SHA1

      9528b4df7d60103b82edf207ba6533b641d8b354

    • SHA256

      932e30b225064e714d489eb2dc8b9fabc78f6f18858afdc34cb55174b128b013

    • SHA512

      28f8669c8ad1b805f4ff5bed7564a4353f160bae8c7b3b2924cebf91073aefa1a4c2ea7e8bb7282b14dd7572e0f596675885611d97cbf420ff30cdc2855c9fce

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3223) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1303) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks