Overview

overview

10

Static

static

3

2e76c81c95...18.dll

windows7-x64

10

2e76c81c95...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e76c81c9530f5cc9c0d175d54edd0fb_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240510-lf5h6afa8w

  • MD5

    2e76c81c9530f5cc9c0d175d54edd0fb

  • SHA1

    cd7faf8d128990e2c962e1754df16dc5e434e847

  • SHA256

    d22e7b922b25053d90483bdbbade13f32e696d985e63a4e708e323776104a2ad

  • SHA512

    b54f176c3b2d77d484b2c03cc309a06f8a130935c51d1e097c5efa8df20d6aa447d819931b72c0e7dbb5f077cfe3567543c614ad572a5ccc95f8fe74e3201328

  • SSDEEP

    12288:yebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7XWd1R:zbLgddQhfdmMSirYbcMNger

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      2e76c81c9530f5cc9c0d175d54edd0fb_JaffaCakes118

    • Size

      5.0MB

    • MD5

      2e76c81c9530f5cc9c0d175d54edd0fb

    • SHA1

      cd7faf8d128990e2c962e1754df16dc5e434e847

    • SHA256

      d22e7b922b25053d90483bdbbade13f32e696d985e63a4e708e323776104a2ad

    • SHA512

      b54f176c3b2d77d484b2c03cc309a06f8a130935c51d1e097c5efa8df20d6aa447d819931b72c0e7dbb5f077cfe3567543c614ad572a5ccc95f8fe74e3201328

    • SSDEEP

      12288:yebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7XWd1R:zbLgddQhfdmMSirYbcMNger

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3210) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks