General

  • Target

    449ea48a04c7ba3ed2f8d12dfecaf6d3

  • Size

    5.0MB

  • Sample

    220720-h68rqadeem

  • MD5

    449ea48a04c7ba3ed2f8d12dfecaf6d3

  • SHA1

    6d982f8010b2c8b19320fbc62b8ee74b7bf55f0a

  • SHA256

    5224aaed555cd7ca6abca61eacd08652cbb4c692eedd2001eb6fb7a30dfc29d5

  • SHA512

    276608ae2dbe86fb2fbe5121acd9a630317935289b77f62c39a30c9c5e586adaaf26a0ef4f253b197e166e13751fdd9562d0097d34bfa6a97efb922285dbb6b0

Malware Config

Targets

    • Target

      449ea48a04c7ba3ed2f8d12dfecaf6d3

    • Size

      5.0MB

    • MD5

      449ea48a04c7ba3ed2f8d12dfecaf6d3

    • SHA1

      6d982f8010b2c8b19320fbc62b8ee74b7bf55f0a

    • SHA256

      5224aaed555cd7ca6abca61eacd08652cbb4c692eedd2001eb6fb7a30dfc29d5

    • SHA512

      276608ae2dbe86fb2fbe5121acd9a630317935289b77f62c39a30c9c5e586adaaf26a0ef4f253b197e166e13751fdd9562d0097d34bfa6a97efb922285dbb6b0

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3230) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1256) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks