General

  • Target

    beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe

  • Size

    3.6MB

  • Sample

    221010-e3nqlaagfm

  • MD5

    f23f3e4b07b9d87f2991e8451850f473

  • SHA1

    3ccd165d37d5a42099351134d284f9c754166765

  • SHA256

    beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29

  • SHA512

    540275a62226de56cab7f3a48b07258985f523d4bb57afca43c5e3dc5f54f4f8c69f885e39267a6f1d0b0e4d2b1b61b19bb813ccfcb71064ba71e9950a373cd7

  • SSDEEP

    49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdJZkeYkjkUqc:Z8qPoBhz1aRxcSUDk36SAEdJu

Malware Config

Targets

    • Target

      beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe

    • Size

      3.6MB

    • MD5

      f23f3e4b07b9d87f2991e8451850f473

    • SHA1

      3ccd165d37d5a42099351134d284f9c754166765

    • SHA256

      beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29

    • SHA512

      540275a62226de56cab7f3a48b07258985f523d4bb57afca43c5e3dc5f54f4f8c69f885e39267a6f1d0b0e4d2b1b61b19bb813ccfcb71064ba71e9950a373cd7

    • SSDEEP

      49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdJZkeYkjkUqc:Z8qPoBhz1aRxcSUDk36SAEdJu

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3372) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1272) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Network Service Scanning

3
T1046

Tasks