wannacry | c5deb35612689e49ec3ad8336cda395a90da5d995c924c9df1ce2ce003178fbc | Triage

Submit
Reports

Overview

overview

Static

static

3

aa718a0288...18.dll

windows7-x64

aa718a0288...18.dll

windows10-2004-x64

Sharing

General

Target

aa718a028875637e1c6eb648706340b6_JaffaCakes118
Size

5.0MB
Sample

240819-laxlcsyhnm
MD5

aa718a028875637e1c6eb648706340b6
SHA1

7710fd39b325c26ec9dbc396c52d281fe2f9090c
SHA256

c5deb35612689e49ec3ad8336cda395a90da5d995c924c9df1ce2ce003178fbc
SHA512

7f994fd0264f65758ff118ec2a726160c887df2b29b57435239a140a2be6e31e97f4d65ebaf04b2380271e691eb9f6166e88c3bcb0fda9c23a5f2ae281e43e98
SSDEEP

12288:T1bLgmluCtgQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEy:RbLgurgQhfdmMSirYbcMNgef0QeQjG/

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

aa718a028875637e1c6eb648706340b6_JaffaCakes118.dll

Resource

win7-20240729-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

aa718a028875637e1c6eb648706340b6_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  aa718a028875637e1c6eb648706340b6_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  aa718a028875637e1c6eb648706340b6
- SHA1
  
  7710fd39b325c26ec9dbc396c52d281fe2f9090c
- SHA256
  
  c5deb35612689e49ec3ad8336cda395a90da5d995c924c9df1ce2ce003178fbc
- SHA512
  
  7f994fd0264f65758ff118ec2a726160c887df2b29b57435239a140a2be6e31e97f4d65ebaf04b2380271e691eb9f6166e88c3bcb0fda9c23a5f2ae281e43e98
- SSDEEP
  
  12288:T1bLgmluCtgQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEy:RbLgurgQhfdmMSirYbcMNgef0QeQjG/
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3182) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2025

Terms | Privacy