General

  • Target

    2310190fcd861b0dd0832d122f9d92b8

  • Size

    2MB

  • Sample

    220906-1fjn1sfgal

  • MD5

    2310190fcd861b0dd0832d122f9d92b8

  • SHA1

    9ed1517372f1284abd12aa262b44f6228e8797cc

  • SHA256

    5cfff54d479414a3a3df2a0ae45cc336c7d7659cd7375f1bf6f3cc2d57deb893

  • SHA512

    b5c92fe245b7dee499336111bba4b925b1f60438fa27166735d51faeb36b976ff87a7023996add84e0c52f7d2ec8942e3b5d7aedd6de17dafa808c09892eee76

Malware Config

Targets

    • Target

      2310190fcd861b0dd0832d122f9d92b8

    • Size

      2MB

    • MD5

      2310190fcd861b0dd0832d122f9d92b8

    • SHA1

      9ed1517372f1284abd12aa262b44f6228e8797cc

    • SHA256

      5cfff54d479414a3a3df2a0ae45cc336c7d7659cd7375f1bf6f3cc2d57deb893

    • SHA512

      b5c92fe245b7dee499336111bba4b925b1f60438fa27166735d51faeb36b976ff87a7023996add84e0c52f7d2ec8942e3b5d7aedd6de17dafa808c09892eee76

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3302) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (735) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation