General

  • Target

    ed6560178d30410f2a3e4e99c950b5a5_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240920-mja96asbmq

  • MD5

    ed6560178d30410f2a3e4e99c950b5a5

  • SHA1

    a1f15ecc13181a7d83f056cfff32239b982912fd

  • SHA256

    58ddee0e15b3279de8a703cf5b14189edf1f90b83fed266265fba7dfe6e6a910

  • SHA512

    b53613495c125e6cce1dc98268917dcda60dbb2d8d89b59c9ed40535017dee52dc05440007761217f816590e37643d744af33a1b0ba2761bec563c3804d2f68b

  • SSDEEP

    49152:SnAQqMSPbcBVQej/1INRPvxJMdAMEcaEau3R8yAH1plAH:+DqPoBhz1aR3xWd593R8yAVp2H

Malware Config

Targets

    • Target

      ed6560178d30410f2a3e4e99c950b5a5_JaffaCakes118

    • Size

      5.0MB

    • MD5

      ed6560178d30410f2a3e4e99c950b5a5

    • SHA1

      a1f15ecc13181a7d83f056cfff32239b982912fd

    • SHA256

      58ddee0e15b3279de8a703cf5b14189edf1f90b83fed266265fba7dfe6e6a910

    • SHA512

      b53613495c125e6cce1dc98268917dcda60dbb2d8d89b59c9ed40535017dee52dc05440007761217f816590e37643d744af33a1b0ba2761bec563c3804d2f68b

    • SSDEEP

      49152:SnAQqMSPbcBVQej/1INRPvxJMdAMEcaEau3R8yAH1plAH:+DqPoBhz1aR3xWd593R8yAVp2H

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3318) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks