Overview

overview

10

Static

static

3

556363d5a4...18.exe

windows7-x64

10

556363d5a4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    556363d5a4c9653ff11d7ab1f4d81600_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240518-sn3g4ahg35

  • MD5

    556363d5a4c9653ff11d7ab1f4d81600

  • SHA1

    08c6f4ccaf15d8c5b210928f68212aa0cc67d4b3

  • SHA256

    4fd78a7a6c61e8bd02d759e1e2ee5d5ce9803409671b3aef2f828760c497c334

  • SHA512

    b8f9700deb13565660d9c4842070bd0969396e18eeadd955737b2ca0fe46b34a71e20f8fa8805db17ab9f45e3c9fcfeefe466826d2cb813f18ee090fe8cf8684

  • SSDEEP

    49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      556363d5a4c9653ff11d7ab1f4d81600_JaffaCakes118

    • Size

      3.6MB

    • MD5

      556363d5a4c9653ff11d7ab1f4d81600

    • SHA1

      08c6f4ccaf15d8c5b210928f68212aa0cc67d4b3

    • SHA256

      4fd78a7a6c61e8bd02d759e1e2ee5d5ce9803409671b3aef2f828760c497c334

    • SHA512

      b8f9700deb13565660d9c4842070bd0969396e18eeadd955737b2ca0fe46b34a71e20f8fa8805db17ab9f45e3c9fcfeefe466826d2cb813f18ee090fe8cf8684

    • SSDEEP

      49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3204) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks