General

  • Target

    de02a847a18547aef3617b211dd8ed08

  • Size

    5.0MB

  • Sample

    220720-janmcadba9

  • MD5

    de02a847a18547aef3617b211dd8ed08

  • SHA1

    cdfb40c1c08fbe86b9a82a3d813df9d92ec049c3

  • SHA256

    4244b83d32b31b5090b64b6bc8289542d3dc7889aff6ce7041ba33eda27ee424

  • SHA512

    a0e1afaffb041477ba52877aac16a482a55106f10839d3b422126f86ad441339292a5c1cb38c12925354cc1c7beddf454eb6627a2e73b49e1c383f2d52c858e9

Malware Config

Targets

    • Target

      de02a847a18547aef3617b211dd8ed08

    • Size

      5.0MB

    • MD5

      de02a847a18547aef3617b211dd8ed08

    • SHA1

      cdfb40c1c08fbe86b9a82a3d813df9d92ec049c3

    • SHA256

      4244b83d32b31b5090b64b6bc8289542d3dc7889aff6ce7041ba33eda27ee424

    • SHA512

      a0e1afaffb041477ba52877aac16a482a55106f10839d3b422126f86ad441339292a5c1cb38c12925354cc1c7beddf454eb6627a2e73b49e1c383f2d52c858e9

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3245) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1170) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks