General

  • Target

    4ad1c846f0916c22245cb0b9ef180ccb_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240516-ngxaaaaa8s

  • MD5

    4ad1c846f0916c22245cb0b9ef180ccb

  • SHA1

    2d9dda92ae22c9ddb10f4df5fd9b13aaec105f41

  • SHA256

    7aac9e7d56c3690c646895683858c0970b6470a7230a36423c3d13a53d786d21

  • SHA512

    2271c9123a950f865226d4e0e5adc18c0eb7c23418bb07bb1174afea2fa6932f5b4ce68512d3103674e2b65feec8b9ac58fcb0cc23b2981333e619a17e299cac

  • SSDEEP

    98304:TDqPoB/1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:TDqPQ1Cxcxk3ZAEUadzR8yc4H

Malware Config

Targets

    • Target

      4ad1c846f0916c22245cb0b9ef180ccb_JaffaCakes118

    • Size

      5.0MB

    • MD5

      4ad1c846f0916c22245cb0b9ef180ccb

    • SHA1

      2d9dda92ae22c9ddb10f4df5fd9b13aaec105f41

    • SHA256

      7aac9e7d56c3690c646895683858c0970b6470a7230a36423c3d13a53d786d21

    • SHA512

      2271c9123a950f865226d4e0e5adc18c0eb7c23418bb07bb1174afea2fa6932f5b4ce68512d3103674e2b65feec8b9ac58fcb0cc23b2981333e619a17e299cac

    • SSDEEP

      98304:TDqPoB/1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:TDqPQ1Cxcxk3ZAEUadzR8yc4H

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3203) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks