Overview

overview

10

Static

static

629e370b1d...73.dll

windows7-x64

10

629e370b1d...73.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    629e370b1d3ba9bf6724d7054bc89073

  • Size

    5.0MB

  • Sample

    220720-dqrfaabcc6

  • MD5

    629e370b1d3ba9bf6724d7054bc89073

  • SHA1

    76ec26415b600f0d373bd5fa24113e36b0f10ab3

  • SHA256

    fcf337a1914aa74016ddbc369980bf9a703e9eafc80c8e7053c642ef0052266f

  • SHA512

    2cc62c6eb7d50a1115f864fb0ee09930f5b87d3c5e83f5393e5650c81db265ee14724f348cb24260d6c255c45d7554544a968952843b37fd6ef061328f7152c2

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      629e370b1d3ba9bf6724d7054bc89073

    • Size

      5.0MB

    • MD5

      629e370b1d3ba9bf6724d7054bc89073

    • SHA1

      76ec26415b600f0d373bd5fa24113e36b0f10ab3

    • SHA256

      fcf337a1914aa74016ddbc369980bf9a703e9eafc80c8e7053c642ef0052266f

    • SHA512

      2cc62c6eb7d50a1115f864fb0ee09930f5b87d3c5e83f5393e5650c81db265ee14724f348cb24260d6c255c45d7554544a968952843b37fd6ef061328f7152c2

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3294) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1291) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

3
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks