wannacry | 5f5f968e09e70cdf86b068b838c9c243a785e74e778888d692846787c626ae8b | Triage

Submit
Reports

Overview

overview

Static

static

3

e9b79709d1...18.dll

windows7-x64

e9b79709d1...18.dll

windows10-2004-x64

Sharing

General

Target

e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118
Size

5.0MB
Sample

240918-wz6knswfrm
MD5

e9b79709d134383b794c653aa3ccaa3a
SHA1

f16c829e858af625b894c7d35a7977877b45dfbf
SHA256

5f5f968e09e70cdf86b068b838c9c243a785e74e778888d692846787c626ae8b
SHA512

573021c0326c0587d6e74b8a9cbfe119bf000b006e827fbe51040893951b12f0d1d790161b90c4f0899a90e1bb5d074044d1337ef3eaea435958ae990163e624
SSDEEP

24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/9pNZtA0p+9XEk:SnAQqMSPbcBVQej/1INRAW+9plAH

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118.dll

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  e9b79709d134383b794c653aa3ccaa3a
- SHA1
  
  f16c829e858af625b894c7d35a7977877b45dfbf
- SHA256
  
  5f5f968e09e70cdf86b068b838c9c243a785e74e778888d692846787c626ae8b
- SHA512
  
  573021c0326c0587d6e74b8a9cbfe119bf000b006e827fbe51040893951b12f0d1d790161b90c4f0899a90e1bb5d074044d1337ef3eaea435958ae990163e624
- SSDEEP
  
  24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/9pNZtA0p+9XEk:SnAQqMSPbcBVQej/1INRAW+9plAH
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3117) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy