wannacry | 0e1ea0693da53cd5c2cd89da3feec4b44f2caf653f461ed1f7123bb6640e3a66 | Triage

Submit
Reports

Overview

overview

Static

static

3

e19f1bfc80...18.dll

windows7-x64

e19f1bfc80...18.dll

windows10-2004-x64

Sharing

General

Target

e19f1bfc80c2efd58a78e80e4b1b3abb_JaffaCakes118
Size

5.0MB
Sample

240915-d285gatdqf
MD5

e19f1bfc80c2efd58a78e80e4b1b3abb
SHA1

d198cf287892f6ea3eeef8504ec3d0d99d826d49
SHA256

0e1ea0693da53cd5c2cd89da3feec4b44f2caf653f461ed1f7123bb6640e3a66
SHA512

fa16a3face3682724f2f4caf0e22898dd2cdf77c42ace6332d48190b172e9cd17363a759688f7126a65f3a9cfe5540e94bbd61ba9e12c543252ab5a7b5f4983c
SSDEEP

49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAFaEau3R8yAFHAD:TDqPoBhz1aRxcSUDk36SAq3R8yA

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e19f1bfc80c2efd58a78e80e4b1b3abb_JaffaCakes118.dll

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

e19f1bfc80c2efd58a78e80e4b1b3abb_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  e19f1bfc80c2efd58a78e80e4b1b3abb_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  e19f1bfc80c2efd58a78e80e4b1b3abb
- SHA1
  
  d198cf287892f6ea3eeef8504ec3d0d99d826d49
- SHA256
  
  0e1ea0693da53cd5c2cd89da3feec4b44f2caf653f461ed1f7123bb6640e3a66
- SHA512
  
  fa16a3face3682724f2f4caf0e22898dd2cdf77c42ace6332d48190b172e9cd17363a759688f7126a65f3a9cfe5540e94bbd61ba9e12c543252ab5a7b5f4983c
- SSDEEP
  
  49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAFaEau3R8yAFHAD:TDqPoBhz1aRxcSUDk36SAq3R8yA
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3269) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy