General

  • Target

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll

  • Size

    5MB

  • Sample

    220921-egsgnaaeck

  • MD5

    f019831d5f37a996e5f8f7338de3f50d

  • SHA1

    e52d9f459059e297a0802d4c99cabf9b8f9540ff

  • SHA256

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3

  • SHA512

    cee576bd57d2dd20df722d19cb797db022e832f2ca281c499b473685a25f51586843ffd8ffef898f02e8ab8fbbc984cc913eca591670560594aaf9b2ad9f70db

Malware Config

Targets

    • Target

      0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll

    • Size

      5MB

    • MD5

      f019831d5f37a996e5f8f7338de3f50d

    • SHA1

      e52d9f459059e297a0802d4c99cabf9b8f9540ff

    • SHA256

      0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3

    • SHA512

      cee576bd57d2dd20df722d19cb797db022e832f2ca281c499b473685a25f51586843ffd8ffef898f02e8ab8fbbc984cc913eca591670560594aaf9b2ad9f70db

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3130) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1264) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation