Overview

overview

10

Static

static

3

18d51863b3...18.dll

windows7-x64

10

18d51863b3...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d51863b310936151866a7979cd33df_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240505-w69wnshe41

  • MD5

    18d51863b310936151866a7979cd33df

  • SHA1

    3cd0e475d35ef115e8f7be95a9fa13bd696641fc

  • SHA256

    2f6ae3de34a41f779d44892c7fab9a1f0ca3308ab3e63c9dc05dc1297e5f8460

  • SHA512

    e93097f328cb1f7a0060188e61707d6bb833da09415835978a81abd5b2a0bed7a86e95bccbe48f47abcea6e7d59ed62a4428c3a74493ef2a6bd116aea36c19d4

  • SSDEEP

    98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P5q3R8yAVp2H:dDqPe1Cxcxk3ZAEUaduR8yc4H

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      18d51863b310936151866a7979cd33df_JaffaCakes118

    • Size

      5.0MB

    • MD5

      18d51863b310936151866a7979cd33df

    • SHA1

      3cd0e475d35ef115e8f7be95a9fa13bd696641fc

    • SHA256

      2f6ae3de34a41f779d44892c7fab9a1f0ca3308ab3e63c9dc05dc1297e5f8460

    • SHA512

      e93097f328cb1f7a0060188e61707d6bb833da09415835978a81abd5b2a0bed7a86e95bccbe48f47abcea6e7d59ed62a4428c3a74493ef2a6bd116aea36c19d4

    • SSDEEP

      98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P5q3R8yAVp2H:dDqPe1Cxcxk3ZAEUaduR8yc4H

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3340) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks