Overview

overview

10

Static

static

3

c974b00c7d...18.dll

windows7-x64

10

c974b00c7d...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c974b00c7df1cd75b4112d79ac9fa6a0_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240829-xxvwtswhqb

  • MD5

    c974b00c7df1cd75b4112d79ac9fa6a0

  • SHA1

    32a2087ef990a97dd9a411928e3aacb67292f7d6

  • SHA256

    51f8d763eb146e8c5c4d8732bee44a11474905b3f8fdc91cdd6008a6ac0f9c34

  • SHA512

    44d2da65c1eebeab7f22bf2fcab2268de3486be1bda1ff9786dd20f2ada87e261934a2e5ee96aab50a9cec880f430374b5cbf65a83cf827eac049e4444adc7f2

  • SSDEEP

    24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIUt/8uME71NZtA0p+9XEk:SnAQqMSPbcBVQej/F3RhlAH

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      c974b00c7df1cd75b4112d79ac9fa6a0_JaffaCakes118

    • Size

      5.0MB

    • MD5

      c974b00c7df1cd75b4112d79ac9fa6a0

    • SHA1

      32a2087ef990a97dd9a411928e3aacb67292f7d6

    • SHA256

      51f8d763eb146e8c5c4d8732bee44a11474905b3f8fdc91cdd6008a6ac0f9c34

    • SHA512

      44d2da65c1eebeab7f22bf2fcab2268de3486be1bda1ff9786dd20f2ada87e261934a2e5ee96aab50a9cec880f430374b5cbf65a83cf827eac049e4444adc7f2

    • SSDEEP

      24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIUt/8uME71NZtA0p+9XEk:SnAQqMSPbcBVQej/F3RhlAH

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3283) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks