Overview

overview

10

Static

static

3

mssecsvr.exe

windows7-x64

10

mssecsvr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mssecsvr.exe

  • Size

    2.2MB

  • Sample

    240324-l9qbbsbg99

  • MD5

    60a91a498c0f1ffddef484c5a4d42564

  • SHA1

    a15dcd408c0aee1f5f38b50528583bdee6536227

  • SHA256

    03dc66c9970481c5958d247f9eba93a6a7ad9f9bbf94845b9fbea8ed1e1e0757

  • SHA512

    e7b7a308227fc3c72d8d1bd262389257e1f2fa419f6ceff58f73a06f850245f6e1068ea74cf42388ee2ca2712d7b5d9a2ce0e6f7264c3885b82c1caa70891e55

  • SSDEEP

    12288:eQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:VbLguVQhfdmMSirYbcMNgef0QeQjG

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      mssecsvr.exe

    • Size

      2.2MB

    • MD5

      60a91a498c0f1ffddef484c5a4d42564

    • SHA1

      a15dcd408c0aee1f5f38b50528583bdee6536227

    • SHA256

      03dc66c9970481c5958d247f9eba93a6a7ad9f9bbf94845b9fbea8ed1e1e0757

    • SHA512

      e7b7a308227fc3c72d8d1bd262389257e1f2fa419f6ceff58f73a06f850245f6e1068ea74cf42388ee2ca2712d7b5d9a2ce0e6f7264c3885b82c1caa70891e55

    • SSDEEP

      12288:eQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:VbLguVQhfdmMSirYbcMNgef0QeQjG

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3209) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks