General

  • Target

    d7ec2cdb973d9ad2e489fa0c7b3ffeb4

  • Size

    5MB

  • Sample

    220825-ybhvtaaga7

  • MD5

    d7ec2cdb973d9ad2e489fa0c7b3ffeb4

  • SHA1

    94466fff257c5e2135e5db48a7e4a0b1ab381d26

  • SHA256

    a7a578d123a9a77ec5ed304e5a4421a7f2ec27504afe6e96d1ffc9bf51a4dee1

  • SHA512

    0eebfbc58ff348eb00f89c11f6d81e2a4a063621d0a31b0c134ce46660f1faa11a582cfedb7710f127e8e8b696f4c473e091695a84e43d1852dba157339f8ead

  • SSDEEP

    98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:TDqPe1Cxcxk3ZAEUadz

Malware Config

Targets

    • Target

      d7ec2cdb973d9ad2e489fa0c7b3ffeb4

    • Size

      5MB

    • MD5

      d7ec2cdb973d9ad2e489fa0c7b3ffeb4

    • SHA1

      94466fff257c5e2135e5db48a7e4a0b1ab381d26

    • SHA256

      a7a578d123a9a77ec5ed304e5a4421a7f2ec27504afe6e96d1ffc9bf51a4dee1

    • SHA512

      0eebfbc58ff348eb00f89c11f6d81e2a4a063621d0a31b0c134ce46660f1faa11a582cfedb7710f127e8e8b696f4c473e091695a84e43d1852dba157339f8ead

    • SSDEEP

      98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:TDqPe1Cxcxk3ZAEUadz

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (2953) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1259) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Tasks