Overview

overview

10

Static

static

3

22b9d0b045...18.dll

windows7-x64

10

22b9d0b045...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22b9d0b04561d433fc293e20c0703aa0_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240508-cgsrbach4v

  • MD5

    22b9d0b04561d433fc293e20c0703aa0

  • SHA1

    fefde27fdefcf772f2bedca7f474d3b78b0c654f

  • SHA256

    c6718548d063db905a69b88eb199f963f6e3a0a845821c3625c820618dc6a936

  • SHA512

    69bbc5034724f3005c18ba61856c68a3b5f7790c3544dcd5e9061c66f58d09399391a5c8e06128b04bec1417313088911a1ee0c3f37fe2bae9a32de370b60b19

  • SSDEEP

    49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAME:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      22b9d0b04561d433fc293e20c0703aa0_JaffaCakes118

    • Size

      5.0MB

    • MD5

      22b9d0b04561d433fc293e20c0703aa0

    • SHA1

      fefde27fdefcf772f2bedca7f474d3b78b0c654f

    • SHA256

      c6718548d063db905a69b88eb199f963f6e3a0a845821c3625c820618dc6a936

    • SHA512

      69bbc5034724f3005c18ba61856c68a3b5f7790c3544dcd5e9061c66f58d09399391a5c8e06128b04bec1417313088911a1ee0c3f37fe2bae9a32de370b60b19

    • SSDEEP

      49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAME:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3190) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks