General

  • Target

    dfb508f82ab7809d3f0266d852009a99_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240914-hv1a7ssdlc

  • MD5

    dfb508f82ab7809d3f0266d852009a99

  • SHA1

    b3987ad6c7e7cc751a63c89a307b335b86e1d78b

  • SHA256

    1ef876ab0e4b0885f1585753423999b8fce935c87b77f9274aa1debff01efe7c

  • SHA512

    a67cc2fa77864a3b35345cd63760865bb0dc2a579e3dbd543a9904a0563f46815115116848e7ade48d6df094ed77787d2de182414937f396e3953e1b44b55dbe

  • SSDEEP

    98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2owc:d8qPe1Cxcxk3ZAEUadzR8yc4

Malware Config

Targets

    • Target

      dfb508f82ab7809d3f0266d852009a99_JaffaCakes118

    • Size

      5.0MB

    • MD5

      dfb508f82ab7809d3f0266d852009a99

    • SHA1

      b3987ad6c7e7cc751a63c89a307b335b86e1d78b

    • SHA256

      1ef876ab0e4b0885f1585753423999b8fce935c87b77f9274aa1debff01efe7c

    • SHA512

      a67cc2fa77864a3b35345cd63760865bb0dc2a579e3dbd543a9904a0563f46815115116848e7ade48d6df094ed77787d2de182414937f396e3953e1b44b55dbe

    • SSDEEP

      98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2owc:d8qPe1Cxcxk3ZAEUadzR8yc4

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3240) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks