wannacry | ba8179c3448afe4420ed0afa4eee05e8955ae8d1e10bfd5a4d3de1e12f19763d | Triage

Submit
Reports

Overview

overview

Static

static

3

c475b82f1e...18.dll

windows7-x64

c475b82f1e...18.dll

windows10-2004-x64

Sharing

General

Target

c475b82f1e0b421e051622f034b1d5e3_JaffaCakes118
Size

5.0MB
Sample

240827-gwdm6awepb
MD5

c475b82f1e0b421e051622f034b1d5e3
SHA1

e1cfa940659f8dcf46098f67ec3de711e7123cb5
SHA256

ba8179c3448afe4420ed0afa4eee05e8955ae8d1e10bfd5a4d3de1e12f19763d
SHA512

bbc36d925fb888af9224c1414ac2c9a9d2f6b3cdbc356983d4483a5dab3ec891481de74c55b681214d0468802b3cf49f4c9d050438bec6ad850577d167a30494
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:TDqPe1Cxcxk3ZAEUadzRkc4H

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c475b82f1e0b421e051622f034b1d5e3_JaffaCakes118.dll

Resource

win7-20240704-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c475b82f1e0b421e051622f034b1d5e3_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  c475b82f1e0b421e051622f034b1d5e3_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  c475b82f1e0b421e051622f034b1d5e3
- SHA1
  
  e1cfa940659f8dcf46098f67ec3de711e7123cb5
- SHA256
  
  ba8179c3448afe4420ed0afa4eee05e8955ae8d1e10bfd5a4d3de1e12f19763d
- SHA512
  
  bbc36d925fb888af9224c1414ac2c9a9d2f6b3cdbc356983d4483a5dab3ec891481de74c55b681214d0468802b3cf49f4c9d050438bec6ad850577d167a30494
- SSDEEP
  
  98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:TDqPe1Cxcxk3ZAEUadzRkc4H
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3175) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy