General

  • Target

    a20b830eaa9ca1bab18f04ba8716060a

  • Size

    5.0MB

  • Sample

    220720-h8y1asdah6

  • MD5

    a20b830eaa9ca1bab18f04ba8716060a

  • SHA1

    38d5ff02d3384a37437d4f1bca6fc98baf23259c

  • SHA256

    0d94f982d33c4e02b830722d304d8fe719b1086cb68e38b57102672932b7e0f1

  • SHA512

    65cd32a2b3f36664ed288cc9b5bd2dc5833312e05c614cfecb9d80d0b33535f369938b6a144f8dc2ea552683b0f65f05f32d6c72848385bf852f542a2857b0c2

Malware Config

Targets

    • Target

      a20b830eaa9ca1bab18f04ba8716060a

    • Size

      5.0MB

    • MD5

      a20b830eaa9ca1bab18f04ba8716060a

    • SHA1

      38d5ff02d3384a37437d4f1bca6fc98baf23259c

    • SHA256

      0d94f982d33c4e02b830722d304d8fe719b1086cb68e38b57102672932b7e0f1

    • SHA512

      65cd32a2b3f36664ed288cc9b5bd2dc5833312e05c614cfecb9d80d0b33535f369938b6a144f8dc2ea552683b0f65f05f32d6c72848385bf852f542a2857b0c2

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3316) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (972) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks