wannacry | 43501ea65f62d22f6c1b1fd10ea04feefb513f18d05217e5090f001f4180fa9d | Triage

Submit
Reports

Overview

overview

Static

static

3

660e3d0835...18.dll

windows7-x64

660e3d0835...18.dll

windows10-2004-x64

Sharing

General

Target

660e3d0835ba930aac57a0590eb0d5c5_JaffaCakes118
Size

5.0MB
Sample

240522-fgl6bacd89
MD5

660e3d0835ba930aac57a0590eb0d5c5
SHA1

d0a496937233b8fe6bb5b43c1878ec2f3c1049b8
SHA256

43501ea65f62d22f6c1b1fd10ea04feefb513f18d05217e5090f001f4180fa9d
SHA512

752a4dee87dc749047c53c8a035444e7a88462a0951cf49b6c018b5a3790d955e870074898ddfeb45c205192238d1d54d01bdeee34144f11f409b5eef987368f
SSDEEP

12288:ywbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+4F8SNTJYsVr7D:JbLgdeQhfdmMSirYbcMNgefuF8S9r7D

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

660e3d0835ba930aac57a0590eb0d5c5_JaffaCakes118.dll

Resource

win7-20240221-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

660e3d0835ba930aac57a0590eb0d5c5_JaffaCakes118.dll

Resource

win10v2004-20240508-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  660e3d0835ba930aac57a0590eb0d5c5_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  660e3d0835ba930aac57a0590eb0d5c5
- SHA1
  
  d0a496937233b8fe6bb5b43c1878ec2f3c1049b8
- SHA256
  
  43501ea65f62d22f6c1b1fd10ea04feefb513f18d05217e5090f001f4180fa9d
- SHA512
  
  752a4dee87dc749047c53c8a035444e7a88462a0951cf49b6c018b5a3790d955e870074898ddfeb45c205192238d1d54d01bdeee34144f11f409b5eef987368f
- SSDEEP
  
  12288:ywbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+4F8SNTJYsVr7D:JbLgdeQhfdmMSirYbcMNgefuF8S9r7D
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3346) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy