General

  • Target

    306592b5c9ddf51d26225e51da3d8f9c3b3e51dc6b101043998cb3fce57cdc7f

  • Size

    5.0MB

  • Sample

    221027-c52dcsadal

  • MD5

    e5253585af59f9701f1a788ae87b9e73

  • SHA1

    e1b192fbbde83210802b354dcef2c37aaa180ee2

  • SHA256

    306592b5c9ddf51d26225e51da3d8f9c3b3e51dc6b101043998cb3fce57cdc7f

  • SHA512

    3cda3ffa99b88ca95c5b52da8a189eac285b9401238355f375b202acbf338b688cb63cb375af791d8a9de38785201f6121a363f5239eb94e41aaff8d67751f70

  • SSDEEP

    24576:RbLgudQhZdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL:RnNQ8MSPbcBVQej/1IN

Malware Config

Targets

    • Target

      306592b5c9ddf51d26225e51da3d8f9c3b3e51dc6b101043998cb3fce57cdc7f

    • Size

      5.0MB

    • MD5

      e5253585af59f9701f1a788ae87b9e73

    • SHA1

      e1b192fbbde83210802b354dcef2c37aaa180ee2

    • SHA256

      306592b5c9ddf51d26225e51da3d8f9c3b3e51dc6b101043998cb3fce57cdc7f

    • SHA512

      3cda3ffa99b88ca95c5b52da8a189eac285b9401238355f375b202acbf338b688cb63cb375af791d8a9de38785201f6121a363f5239eb94e41aaff8d67751f70

    • SSDEEP

      24576:RbLgudQhZdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL:RnNQ8MSPbcBVQej/1IN

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3212) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1250) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks