wannacry | 6a3f3dbadb3325deed042ff9f91ccc369e84d82a32c48bf2ecae3f2973adaa1c | Triage

Submit
Reports

Overview

overview

Static

static

3

c86e150851...18.dll

windows7-x64

c86e150851...18.dll

windows10-2004-x64

Sharing

General

Target

c86e15085144ad16a9a62bb67c4d4042_JaffaCakes118
Size

5.0MB
Sample

240829-h9chpasakj
MD5

c86e15085144ad16a9a62bb67c4d4042
SHA1

15d3174e8b8f3dd171ef5fbc463fbcf6b588f60d
SHA256

6a3f3dbadb3325deed042ff9f91ccc369e84d82a32c48bf2ecae3f2973adaa1c
SHA512

89c34c1fb3671f03a1d9e7dc86cce920bece27243abaf15f12acabe95cdaa3e25dae16aa04dab8b581667668e8f426f3998fa75e1449e35e88c7f28a70a56e13
SSDEEP

12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:SbLgddQhfdmMSirYbcMNgef0

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c86e15085144ad16a9a62bb67c4d4042_JaffaCakes118.dll

Resource

win7-20240705-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c86e15085144ad16a9a62bb67c4d4042_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  c86e15085144ad16a9a62bb67c4d4042_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  c86e15085144ad16a9a62bb67c4d4042
- SHA1
  
  15d3174e8b8f3dd171ef5fbc463fbcf6b588f60d
- SHA256
  
  6a3f3dbadb3325deed042ff9f91ccc369e84d82a32c48bf2ecae3f2973adaa1c
- SHA512
  
  89c34c1fb3671f03a1d9e7dc86cce920bece27243abaf15f12acabe95cdaa3e25dae16aa04dab8b581667668e8f426f3998fa75e1449e35e88c7f28a70a56e13
- SSDEEP
  
  12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:SbLgddQhfdmMSirYbcMNgef0
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3286) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2025

Terms | Privacy