wannacry | e21bc9ecc5f805785c565b22af1927ffb5997c26fce7750f401ad523073a3a59 | Triage

Submit
Reports

Overview

overview

Static

static

3

6a139899ac...18.dll

windows7-x64

6a139899ac...18.dll

windows10-2004-x64

Sharing

General

Target

6a139899acde9af3c79c024bee1a800b_JaffaCakes118
Size

5.0MB
Sample

240724-d1zveayfpb
MD5

6a139899acde9af3c79c024bee1a800b
SHA1

f9b48a632ad7b0c0ece14921ba71703d1045eb44
SHA256

e21bc9ecc5f805785c565b22af1927ffb5997c26fce7750f401ad523073a3a59
SHA512

94b7f4b4826b3ef28edf1c59a17c98337b539b48cf81c3b5bce8b2a54e190102389189bcd305407116dac836603376c79de8089baf98fa728a0567787e692e2b
SSDEEP

98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:d8qPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6a139899acde9af3c79c024bee1a800b_JaffaCakes118.dll

Resource

win7-20240705-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

6a139899acde9af3c79c024bee1a800b_JaffaCakes118.dll

Resource

win10v2004-20240709-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  6a139899acde9af3c79c024bee1a800b_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  6a139899acde9af3c79c024bee1a800b
- SHA1
  
  f9b48a632ad7b0c0ece14921ba71703d1045eb44
- SHA256
  
  e21bc9ecc5f805785c565b22af1927ffb5997c26fce7750f401ad523073a3a59
- SHA512
  
  94b7f4b4826b3ef28edf1c59a17c98337b539b48cf81c3b5bce8b2a54e190102389189bcd305407116dac836603376c79de8089baf98fa728a0567787e692e2b
- SSDEEP
  
  98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:d8qPe1Cxcxk3ZAEUadzR8yc4
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3231) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy