wannacry | 8bbab918a16a0d1f71a56893042b37d9bccba90e5b04c074ed8bd4fd755cc02f | Triage

Submit
Reports

Overview

overview

Static

static

3

0636efc4ba...18.dll

windows7-x64

0636efc4ba...18.dll

windows10-2004-x64

Sharing

General

Target

0636efc4ba52127196acae91afa113e2_JaffaCakes118
Size

5.0MB
Sample

240428-2ftpnabb61
MD5

0636efc4ba52127196acae91afa113e2
SHA1

be34539aa752513108b5a4f5fbbacb91835e74f8
SHA256

8bbab918a16a0d1f71a56893042b37d9bccba90e5b04c074ed8bd4fd755cc02f
SHA512

da78c335edcc29715f8527f503f57cffd46b3417fa69eb55d16ccec369e0c8a8cff342c89afba06f96f4a542b2600070bad03211f728d3840c8eb84b4bd18f9a
SSDEEP

49152:snjQqMSPbcBV1+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3R8SSS:M8qPoBfcSUDk36SAEdhvxWa9P593R8w

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0636efc4ba52127196acae91afa113e2_JaffaCakes118.dll

Resource

win7-20231129-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

0636efc4ba52127196acae91afa113e2_JaffaCakes118.dll

Resource

win10v2004-20240419-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  0636efc4ba52127196acae91afa113e2_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  0636efc4ba52127196acae91afa113e2
- SHA1
  
  be34539aa752513108b5a4f5fbbacb91835e74f8
- SHA256
  
  8bbab918a16a0d1f71a56893042b37d9bccba90e5b04c074ed8bd4fd755cc02f
- SHA512
  
  da78c335edcc29715f8527f503f57cffd46b3417fa69eb55d16ccec369e0c8a8cff342c89afba06f96f4a542b2600070bad03211f728d3840c8eb84b4bd18f9a
- SSDEEP
  
  49152:snjQqMSPbcBV1+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3R8SSS:M8qPoBfcSUDk36SAEdhvxWa9P593R8w
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3200) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy