General

  • Target

    ed83a264c15eed00180b921b5669a0f3_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240920-nx2jyavemn

  • MD5

    ed83a264c15eed00180b921b5669a0f3

  • SHA1

    8949c64f65c678c9b593ea35ac1dfa97af18f713

  • SHA256

    c7c1b3d588adc6f9c5d4f9cd20991d6272deb9e414c5ee41e966256d34f8f24e

  • SHA512

    f7573dfd9f0d7761b635f0895abeee84d9d626a6649b31ab6d5a71a0b0bc1f8c3336278df32e11af47201aa3270c128c77c14f61240f6939b5c5f301598d65e8

  • SSDEEP

    49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQtvxJM0HS:TDqPoBhz1aRxcSUDkQxWaS

Malware Config

Targets

    • Target

      ed83a264c15eed00180b921b5669a0f3_JaffaCakes118

    • Size

      5.0MB

    • MD5

      ed83a264c15eed00180b921b5669a0f3

    • SHA1

      8949c64f65c678c9b593ea35ac1dfa97af18f713

    • SHA256

      c7c1b3d588adc6f9c5d4f9cd20991d6272deb9e414c5ee41e966256d34f8f24e

    • SHA512

      f7573dfd9f0d7761b635f0895abeee84d9d626a6649b31ab6d5a71a0b0bc1f8c3336278df32e11af47201aa3270c128c77c14f61240f6939b5c5f301598d65e8

    • SSDEEP

      49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQtvxJM0HS:TDqPoBhz1aRxcSUDkQxWaS

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3177) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks