Overview

overview

10

Static

static

3

2024-01-29...ry.exe

windows7-x64

10

2024-01-29...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-01-29_db5ad054d99c074b63e9b1681a0cd7de_wannacry

  • Size

    5.0MB

  • Sample

    240129-tdn3dsehel

  • MD5

    db5ad054d99c074b63e9b1681a0cd7de

  • SHA1

    2412e725d7789533537b0e18f3f48f89dbfa7c6e

  • SHA256

    b8112125c596a24629572fcfa1743f0f5149bee4d0c6502e5ecf7d3bbb85eec2

  • SHA512

    ab54877d419422f30165beead136afd9a838d8337f70e412890855a7c8cdea0b86fd45132e79dcf9b9818a05617c2501a04c90ce4ba5c06a439cc49b7d089315

  • SSDEEP

    12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82:2bLgddQhfdmMSirYbcM

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      2024-01-29_db5ad054d99c074b63e9b1681a0cd7de_wannacry

    • Size

      5.0MB

    • MD5

      db5ad054d99c074b63e9b1681a0cd7de

    • SHA1

      2412e725d7789533537b0e18f3f48f89dbfa7c6e

    • SHA256

      b8112125c596a24629572fcfa1743f0f5149bee4d0c6502e5ecf7d3bbb85eec2

    • SHA512

      ab54877d419422f30165beead136afd9a838d8337f70e412890855a7c8cdea0b86fd45132e79dcf9b9818a05617c2501a04c90ce4ba5c06a439cc49b7d089315

    • SSDEEP

      12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82:2bLgddQhfdmMSirYbcM

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3259) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks