Overview

overview

10

Static

static

3

0x000f0000...-2.exe

windows7-x64

10

0x000f0000...-2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mssecsvr.exe_pw_infected.zip

  • Size

    838KB

  • Sample

    240321-kl64haha8x

  • MD5

    1ae70d3bbbc1ad65094b982cad2e4b7b

  • SHA1

    9bda0b119b3e2ac26feeb590cc091c4cbcc5db29

  • SHA256

    14cd9785471f1e4880d7fea240988dca42fceebf84122058c3feef2e10d9a424

  • SHA512

    7d954a98e91c462577c1c4b1d3cdefde8641dfeb6c61e13b1635cc44960917b0e5fd30971592dc5bf4e1d7958f7b0e81517bbb6500d9fb2ec148e4ce45534d14

  • SSDEEP

    24576:4U3JARIqjOwEemSFceQlr8032JnG4IVLgLHAbmYX:NmRIqjTFLgrvmJnfgLcHBW

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      0x000f00000002314e-2

    • Size

      2.2MB

    • MD5

      60a91a498c0f1ffddef484c5a4d42564

    • SHA1

      a15dcd408c0aee1f5f38b50528583bdee6536227

    • SHA256

      03dc66c9970481c5958d247f9eba93a6a7ad9f9bbf94845b9fbea8ed1e1e0757

    • SHA512

      e7b7a308227fc3c72d8d1bd262389257e1f2fa419f6ceff58f73a06f850245f6e1068ea74cf42388ee2ca2712d7b5d9a2ce0e6f7264c3885b82c1caa70891e55

    • SSDEEP

      12288:eQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:VbLguVQhfdmMSirYbcMNgef0QeQjG

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3184) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks