Overview

overview

10

Static

static

c130f2f258...99.dll

windows7-x64

10

c130f2f258...99.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c130f2f25837763dfa434515da012899

  • Size

    5.0MB

  • Sample

    220720-dwbxsabcg2

  • MD5

    c130f2f25837763dfa434515da012899

  • SHA1

    d945495370cff499276c5df54b9a6b43cb796ed0

  • SHA256

    66548a8697f332940ab65a1132538d05b7336a5d36b80c91092d134dd9fb4993

  • SHA512

    92d7d8a1e928b9ac607bfa40378b38d3f9ca51722b3fa9aad63b6c969b84679c6e5d2a24bfbe88a4f31064ef13c1ea13e9342940bc7e7d08a05dddf2c6b00529

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      c130f2f25837763dfa434515da012899

    • Size

      5.0MB

    • MD5

      c130f2f25837763dfa434515da012899

    • SHA1

      d945495370cff499276c5df54b9a6b43cb796ed0

    • SHA256

      66548a8697f332940ab65a1132538d05b7336a5d36b80c91092d134dd9fb4993

    • SHA512

      92d7d8a1e928b9ac607bfa40378b38d3f9ca51722b3fa9aad63b6c969b84679c6e5d2a24bfbe88a4f31064ef13c1ea13e9342940bc7e7d08a05dddf2c6b00529

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3335) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1163) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

3
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks