General

  • Target

    4985a4652236cad5045bd1627d0f233c_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240516-fq6ajsdd95

  • MD5

    4985a4652236cad5045bd1627d0f233c

  • SHA1

    dbb7af1e307d5a9e285c0eac2b1ba65252b71417

  • SHA256

    c26b94b03302aca8d722a0b47cea1b9095ada9baca277718913729ac51a82cfc

  • SHA512

    85a97dd7d5186e57835aa8a67e64d9593b3285bd2ebdf924ad073a9b9523ba8363aabbcc4ea57c9c0969d33bc4d3c20263a3a10e43e44ebd871eddef92d861d7

  • SSDEEP

    49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv0vZ6GIk:d8qPoBhz1aRxcSUDk36SAEdhv0B6GIk

Malware Config

Targets

    • Target

      4985a4652236cad5045bd1627d0f233c_JaffaCakes118

    • Size

      5.0MB

    • MD5

      4985a4652236cad5045bd1627d0f233c

    • SHA1

      dbb7af1e307d5a9e285c0eac2b1ba65252b71417

    • SHA256

      c26b94b03302aca8d722a0b47cea1b9095ada9baca277718913729ac51a82cfc

    • SHA512

      85a97dd7d5186e57835aa8a67e64d9593b3285bd2ebdf924ad073a9b9523ba8363aabbcc4ea57c9c0969d33bc4d3c20263a3a10e43e44ebd871eddef92d861d7

    • SSDEEP

      49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv0vZ6GIk:d8qPoBhz1aRxcSUDk36SAEdhv0B6GIk

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3287) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks