Overview

overview

10

Static

static

0afb07f4dc...a3.dll

windows7-x64

10

0afb07f4dc...a3.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll

  • Size

    5.0MB

  • Sample

    220921-egsgnaaeck

  • MD5

    f019831d5f37a996e5f8f7338de3f50d

  • SHA1

    e52d9f459059e297a0802d4c99cabf9b8f9540ff

  • SHA256

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3

  • SHA512

    cee576bd57d2dd20df722d19cb797db022e832f2ca281c499b473685a25f51586843ffd8ffef898f02e8ab8fbbc984cc913eca591670560594aaf9b2ad9f70db

  • SSDEEP

    49152:RnxQqMSPbcBVQej/1INRx+TSqTdX1HkQ9nK4JKAR:16qPoBhz1aRxcSUDk

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll

    • Size

      5.0MB

    • MD5

      f019831d5f37a996e5f8f7338de3f50d

    • SHA1

      e52d9f459059e297a0802d4c99cabf9b8f9540ff

    • SHA256

      0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3

    • SHA512

      cee576bd57d2dd20df722d19cb797db022e832f2ca281c499b473685a25f51586843ffd8ffef898f02e8ab8fbbc984cc913eca591670560594aaf9b2ad9f70db

    • SSDEEP

      49152:RnxQqMSPbcBVQej/1INRx+TSqTdX1HkQ9nK4JKAR:16qPoBhz1aRxcSUDk

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3130) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1264) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

3
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks