General

  • Target

    f27d3943f18548c0f2d572d63e120493_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240922-v17npa1emc

  • MD5

    f27d3943f18548c0f2d572d63e120493

  • SHA1

    f0c965e91bd85b2b551331011c705eb3cc125186

  • SHA256

    8f2bebe91bc094481c0f08c356d6807fe0981ca86115418fa4c8bf1a0b9380ca

  • SHA512

    cf887429fa2aa53461f3b90c5bdc839d37ff1b9de4e2baa54827a7ed01f67bb301f8c0f9a1281be29c671e8962cdac82a31a88ecfbd584cb2e1983e7c90700e4

  • SSDEEP

    49152:SnAQqMSPbcBVQejU+TSqTdX1HkQo6SAANvc:+DqPoBhwcSUDk36SA

Malware Config

Targets

    • Target

      f27d3943f18548c0f2d572d63e120493_JaffaCakes118

    • Size

      5.0MB

    • MD5

      f27d3943f18548c0f2d572d63e120493

    • SHA1

      f0c965e91bd85b2b551331011c705eb3cc125186

    • SHA256

      8f2bebe91bc094481c0f08c356d6807fe0981ca86115418fa4c8bf1a0b9380ca

    • SHA512

      cf887429fa2aa53461f3b90c5bdc839d37ff1b9de4e2baa54827a7ed01f67bb301f8c0f9a1281be29c671e8962cdac82a31a88ecfbd584cb2e1983e7c90700e4

    • SSDEEP

      49152:SnAQqMSPbcBVQejU+TSqTdX1HkQo6SAANvc:+DqPoBhwcSUDk36SA

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3283) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks