wannacry | 3825e10dab931b98dba12143a8a32ad97d372365c0e3ebfb25f2bccc99260752 | Triage

Submit
Reports

Overview

overview

Static

static

3

c1c5d43ff4...18.dll

windows7-x64

c1c5d43ff4...18.dll

windows10-2004-x64

Sharing

General

Target

c1c5d43ff410806d565e674b124cd185_JaffaCakes118
Size

5.0MB
Sample

240825-21y5wasbmj
MD5

c1c5d43ff410806d565e674b124cd185
SHA1

02c43b7af23015120dd5142ddb357c723a9de610
SHA256

3825e10dab931b98dba12143a8a32ad97d372365c0e3ebfb25f2bccc99260752
SHA512

0d15b825dda1a23b28dc0e8d083dbcec3c881565b44e7c9b5700e651801966fd38bde6360e2017c60fbc8a7f7e5f09ea3ad440d392b626e9c3d08958d54da256
SSDEEP

98304:TDqPo5hz1aRxcSUDk36SA5dhvxWa9P593R8yAVp2H:TDqPK1Cxcxk3ZA5UadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll

Resource

win7-20240704-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  c1c5d43ff410806d565e674b124cd185_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  c1c5d43ff410806d565e674b124cd185
- SHA1
  
  02c43b7af23015120dd5142ddb357c723a9de610
- SHA256
  
  3825e10dab931b98dba12143a8a32ad97d372365c0e3ebfb25f2bccc99260752
- SHA512
  
  0d15b825dda1a23b28dc0e8d083dbcec3c881565b44e7c9b5700e651801966fd38bde6360e2017c60fbc8a7f7e5f09ea3ad440d392b626e9c3d08958d54da256
- SSDEEP
  
  98304:TDqPo5hz1aRxcSUDk36SA5dhvxWa9P593R8yAVp2H:TDqPK1Cxcxk3ZA5UadzR8yc4H
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3059) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2025

Terms | Privacy