Overview

overview

10

Static

static

c7a5616ec4...f3.dll

windows7-x64

10

c7a5616ec4...f3.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7a5616ec44397136f5f747fd2a07cf3

  • Size

    5.0MB

  • Sample

    220720-dafzlsbgal

  • MD5

    c7a5616ec44397136f5f747fd2a07cf3

  • SHA1

    970e5f08ce6428ac743b0d4761e52118d2f3fa22

  • SHA256

    9f0bc1808e4a17e91786a1beb3f8c939dd5b538278497808a1b9d64ab4987638

  • SHA512

    150809ac59e911e08c8df37fe5c40902f486bb21ec5da5b308c1d0d182f330e37f568017d77aebcc989f57b274d71c0cfb56e6431a78e7824c014a581b235098

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      c7a5616ec44397136f5f747fd2a07cf3

    • Size

      5.0MB

    • MD5

      c7a5616ec44397136f5f747fd2a07cf3

    • SHA1

      970e5f08ce6428ac743b0d4761e52118d2f3fa22

    • SHA256

      9f0bc1808e4a17e91786a1beb3f8c939dd5b538278497808a1b9d64ab4987638

    • SHA512

      150809ac59e911e08c8df37fe5c40902f486bb21ec5da5b308c1d0d182f330e37f568017d77aebcc989f57b274d71c0cfb56e6431a78e7824c014a581b235098

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3068) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1244) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks