wannacry | 5c94ef973899d21ac81c5563770ca61e5ff920a342dfb70ba14afb71f41b300b | Triage

Submit
Reports

Overview

overview

Static

static

3

7f9b9aad8b...18.dll

windows7-x64

7f9b9aad8b...18.dll

windows10-2004-x64

Sharing

General

Target

7f9b9aad8bb1108f11027ad0d7989255_JaffaCakes118
Size

5.0MB
Sample

240529-fzxd1abf7w
MD5

7f9b9aad8bb1108f11027ad0d7989255
SHA1

a10f8db721d73de38223e632f8d08ab624dfaafc
SHA256

5c94ef973899d21ac81c5563770ca61e5ff920a342dfb70ba14afb71f41b300b
SHA512

eea0cdbdaad27ac5230d8042708fa8ff8c8d7bec5c049703a741358024136a75dc1f96fc398b5d6f3bd9c09b4d9c47e1049e072badbe82258933c845ddb760d4
SSDEEP

24576:sbLgdeQhfdmMSirYbcMNgef0QeQ4kRiwKt/8uME7A4kqAH1pNZtA0p+9XEk:snjQqMSPbcBVQeRkRiwK3R8yAH1plAH

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7f9b9aad8bb1108f11027ad0d7989255_JaffaCakes118.dll

Resource

win7-20240221-en

wannacry discovery ransomware worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

7f9b9aad8bb1108f11027ad0d7989255_JaffaCakes118.dll

Resource

win10v2004-20240426-en

wannacry discovery ransomware worm

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  7f9b9aad8bb1108f11027ad0d7989255_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  7f9b9aad8bb1108f11027ad0d7989255
- SHA1
  
  a10f8db721d73de38223e632f8d08ab624dfaafc
- SHA256
  
  5c94ef973899d21ac81c5563770ca61e5ff920a342dfb70ba14afb71f41b300b
- SHA512
  
  eea0cdbdaad27ac5230d8042708fa8ff8c8d7bec5c049703a741358024136a75dc1f96fc398b5d6f3bd9c09b4d9c47e1049e072badbe82258933c845ddb760d4
- SSDEEP
  
  24576:sbLgdeQhfdmMSirYbcMNgef0QeQ4kRiwKt/8uME7A4kqAH1pNZtA0p+9XEk:snjQqMSPbcBVQeRkRiwK3R8yAH1plAH
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3251) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy