wannacry | c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56 | Triage

Submit
Reports

Overview

overview

Static

static

c6ed3d06eb...56.dll

windows7-x64

c6ed3d06eb...56.dll

windows10-2004-x64

Sharing

General

Target

c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56
Size

5.0MB
Sample

221101-gsclpagfh5
MD5

07e0ad4a92e0ccd54bbccf2fa459c0ed
SHA1

353b03de9345510a14cd2999bafbe27641dc367c
SHA256

c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56
SHA512

9c4c94849aff932b54e21601de9d8419ba02f20a9a74401c899ebc1ec11efb5afe4c70717da1b16acd62c555316e3a42f733960b946aa9bd3b4987d429bc5278
SSDEEP

49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:TDqPoBhz1aRxcSUDk36SAEdhvxW

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

Behavioral task

behavioral1

Sample

c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56.dll

Resource

win7-20220812-en

wannacry discovery ransomware worm

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56.dll

Resource

win10v2004-20220812-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56
- Size
  
  5.0MB
- MD5
  
  07e0ad4a92e0ccd54bbccf2fa459c0ed
- SHA1
  
  353b03de9345510a14cd2999bafbe27641dc367c
- SHA256
  
  c6ed3d06eb26963013e4f2ba3d03c376650fcf0dcba4d1b3ba55122561c45e56
- SHA512
  
  9c4c94849aff932b54e21601de9d8419ba02f20a9a74401c899ebc1ec11efb5afe4c70717da1b16acd62c555316e3a42f733960b946aa9bd3b4987d429bc5278
- SSDEEP
  
  49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:TDqPoBhz1aRxcSUDk36SAEdhvxW
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2223) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (952) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy