Overview

overview

10

Static

static

0627f0f292...d8.dll

windows7-x64

10

0627f0f292...d8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0627f0f29229e474c78206de082d53d8

  • Size

    5.0MB

  • Sample

    220720-chabcsacg4

  • MD5

    0627f0f29229e474c78206de082d53d8

  • SHA1

    e3fd6cb3f29ee07b9be7bad39824d02b186b8c2b

  • SHA256

    5d8f0c54fd3945b1c2da7295db07fb85bee9761fc82bed542b9c98746bd6bc42

  • SHA512

    499ee633849972f994355c57ef956143ac049e8d033f1d6a7d467043b7065a4a6fb185a9ad502f176b70675a5bb0810ba8c9e06e940ceb1e5f9b859a68bf438a

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      0627f0f29229e474c78206de082d53d8

    • Size

      5.0MB

    • MD5

      0627f0f29229e474c78206de082d53d8

    • SHA1

      e3fd6cb3f29ee07b9be7bad39824d02b186b8c2b

    • SHA256

      5d8f0c54fd3945b1c2da7295db07fb85bee9761fc82bed542b9c98746bd6bc42

    • SHA512

      499ee633849972f994355c57ef956143ac049e8d033f1d6a7d467043b7065a4a6fb185a9ad502f176b70675a5bb0810ba8c9e06e940ceb1e5f9b859a68bf438a

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3136) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1266) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks