General

  • Target

    d0fa940411c82a4958743e2d13cf68d2

  • Size

    5.0MB

  • Sample

    220720-h94l6sdfak

  • MD5

    d0fa940411c82a4958743e2d13cf68d2

  • SHA1

    ec83666e7b93e760bef84db23775a4dae9c1d6fc

  • SHA256

    e09bd9178def7cc30e998d33ce25c4f06d5826f644484226ba0648053df60aff

  • SHA512

    23f1983061c6c3ba31d739e98d2615b3547b806108ed241a37ebec201d9707f10ea538cdeacd09dd66dc81e9b1e6cbca5c0b300186d9464b6a22df41809796ae

Malware Config

Targets

    • Target

      d0fa940411c82a4958743e2d13cf68d2

    • Size

      5.0MB

    • MD5

      d0fa940411c82a4958743e2d13cf68d2

    • SHA1

      ec83666e7b93e760bef84db23775a4dae9c1d6fc

    • SHA256

      e09bd9178def7cc30e998d33ce25c4f06d5826f644484226ba0648053df60aff

    • SHA512

      23f1983061c6c3ba31d739e98d2615b3547b806108ed241a37ebec201d9707f10ea538cdeacd09dd66dc81e9b1e6cbca5c0b300186d9464b6a22df41809796ae

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3265) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1333) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks