General

  • Target

    2024-07-05_7a16760729de317e47f615ff8d6ee7f0_wannacry

  • Size

    5.0MB

  • Sample

    240705-czc4kszgqr

  • MD5

    7a16760729de317e47f615ff8d6ee7f0

  • SHA1

    7f5afab40a4054f58114d03cb1202ee9f3d2313f

  • SHA256

    cc74b8cf65057ccf00ba568072d43a00d571a05aac67a760c70fe19f678c96c7

  • SHA512

    8e2c4f26841183b924a4ea6591adec066c1ed9ee530d3e23fe3a19647bce91171b24b887e2f30cde56412dd044beb72c1fc0a1926b8f9cbbabd2416b403d0a87

  • SSDEEP

    98304:v8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HaKYpfg:v8qPe1Cxcxk3ZAEUadzR8yc4HaI

Malware Config

Targets

    • Target

      2024-07-05_7a16760729de317e47f615ff8d6ee7f0_wannacry

    • Size

      5.0MB

    • MD5

      7a16760729de317e47f615ff8d6ee7f0

    • SHA1

      7f5afab40a4054f58114d03cb1202ee9f3d2313f

    • SHA256

      cc74b8cf65057ccf00ba568072d43a00d571a05aac67a760c70fe19f678c96c7

    • SHA512

      8e2c4f26841183b924a4ea6591adec066c1ed9ee530d3e23fe3a19647bce91171b24b887e2f30cde56412dd044beb72c1fc0a1926b8f9cbbabd2416b403d0a87

    • SSDEEP

      98304:v8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HaKYpfg:v8qPe1Cxcxk3ZAEUadzR8yc4HaI

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3326) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks