Overview

overview

10

Static

static

3

00e61ab5c1...18.exe

windows7-x64

10

00e61ab5c1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00e61ab5c13c15145d12e65f859d0ac0_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240426-q2a9nach49

  • MD5

    00e61ab5c13c15145d12e65f859d0ac0

  • SHA1

    fbca1fb8bb57d9634ce958ba4221e74c548cac18

  • SHA256

    5664b8e08c31a7e2dcb6a090215b65f5436aebe49d4afbead491b5ad0243e964

  • SHA512

    78762149ce48094929afc262e714f71bfb0ed2dd7cc9ebdf49d8c2f925b1378da4923c06bb779a59b2ef8cf97e3d7f17f0683818adbd2972b0cdaee02cddffea

  • SSDEEP

    98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:XDqPe1Cxcxk3ZAEUadzR8yc4

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      00e61ab5c13c15145d12e65f859d0ac0_JaffaCakes118

    • Size

      3.6MB

    • MD5

      00e61ab5c13c15145d12e65f859d0ac0

    • SHA1

      fbca1fb8bb57d9634ce958ba4221e74c548cac18

    • SHA256

      5664b8e08c31a7e2dcb6a090215b65f5436aebe49d4afbead491b5ad0243e964

    • SHA512

      78762149ce48094929afc262e714f71bfb0ed2dd7cc9ebdf49d8c2f925b1378da4923c06bb779a59b2ef8cf97e3d7f17f0683818adbd2972b0cdaee02cddffea

    • SSDEEP

      98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:XDqPe1Cxcxk3ZAEUadzR8yc4

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3320) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks