wannacry | 2bad1462af5db857fe3409fef6624775996b98809a173b8eebe6d48975e8e163 | Triage

Submit
Reports

Overview

overview

Static

static

3

5bda624e07...18.dll

windows7-x64

5bda624e07...18.dll

windows10-2004-x64

Sharing

General

Target

5bda624e072d09feb07b433b013f3410_JaffaCakes118
Size

5.0MB
Sample

240519-2lxy9sef72
MD5

5bda624e072d09feb07b433b013f3410
SHA1

b23db4c3a35942595b86a685a1ab4cfae5f51c41
SHA256

2bad1462af5db857fe3409fef6624775996b98809a173b8eebe6d48975e8e163
SHA512

dd8331004820f823d990f311d30013a5b8db3ffbadded146ef79b2ed695efbdbdf429544a64ae7dfbe4afe0fe67a00921f348466585591d399788efcec18244f
SSDEEP

49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhHEubWAMEcSAH:d8qPoBhz1aRxcSUDk36SAEdhkubW5ZH

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5bda624e072d09feb07b433b013f3410_JaffaCakes118.dll

Resource

win7-20240508-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

5bda624e072d09feb07b433b013f3410_JaffaCakes118.dll

Resource

win10v2004-20240508-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  5bda624e072d09feb07b433b013f3410_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  5bda624e072d09feb07b433b013f3410
- SHA1
  
  b23db4c3a35942595b86a685a1ab4cfae5f51c41
- SHA256
  
  2bad1462af5db857fe3409fef6624775996b98809a173b8eebe6d48975e8e163
- SHA512
  
  dd8331004820f823d990f311d30013a5b8db3ffbadded146ef79b2ed695efbdbdf429544a64ae7dfbe4afe0fe67a00921f348466585591d399788efcec18244f
- SSDEEP
  
  49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhHEubWAMEcSAH:d8qPoBhz1aRxcSUDk36SAEdhkubW5ZH
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3213) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy