Overview

overview

10

Static

static

ff8ea49196...ec.dll

windows7-x64

10

ff8ea49196...ec.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff8ea49196528799c0fdb1e47ed5e3ec

  • Size

    5.0MB

  • Sample

    220720-cykf9sbaa2

  • MD5

    ff8ea49196528799c0fdb1e47ed5e3ec

  • SHA1

    094bd6f96d579758ec5bcb309120af21d8565bbc

  • SHA256

    7f4b708137ae129c1593958858d258496dd06d95efb1aac4b56fdeea970c62f7

  • SHA512

    1f549f5c1ac0dac40584020e3752838c93b1a457986ab4568776739619488421dd60e4dcf6d242c1fc6a8284e83d22792ef8ae6db52b716e2f98f330a5b72fe3

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      ff8ea49196528799c0fdb1e47ed5e3ec

    • Size

      5.0MB

    • MD5

      ff8ea49196528799c0fdb1e47ed5e3ec

    • SHA1

      094bd6f96d579758ec5bcb309120af21d8565bbc

    • SHA256

      7f4b708137ae129c1593958858d258496dd06d95efb1aac4b56fdeea970c62f7

    • SHA512

      1f549f5c1ac0dac40584020e3752838c93b1a457986ab4568776739619488421dd60e4dcf6d242c1fc6a8284e83d22792ef8ae6db52b716e2f98f330a5b72fe3

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (2543) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1284) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks