General

  • Target

    f2e2d36f1ca62d2ca0e2d2048ff9bd8f_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240923-xaablszhrc

  • MD5

    f2e2d36f1ca62d2ca0e2d2048ff9bd8f

  • SHA1

    2e6b1cc6d6be41f90b5c775148ebc234a54f5d3b

  • SHA256

    0d4245b5b2282c6f37e0b24f9c12c2f7034a4aa35334c87c1aa8dfe271e35d14

  • SHA512

    4bdb9c83d251b252ef06c30b28b4f8101aacb2aed8b7c36acd68b96472eb415c1d15f487cc5231f0124ee3a8a3f21ac9dac08b6c1183b1d8afa3f89b329af694

  • SSDEEP

    24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL7DauvgI8+75ST:SnAQqMSPbcBVQej/1INPuLN

Malware Config

Targets

    • Target

      f2e2d36f1ca62d2ca0e2d2048ff9bd8f_JaffaCakes118

    • Size

      5.0MB

    • MD5

      f2e2d36f1ca62d2ca0e2d2048ff9bd8f

    • SHA1

      2e6b1cc6d6be41f90b5c775148ebc234a54f5d3b

    • SHA256

      0d4245b5b2282c6f37e0b24f9c12c2f7034a4aa35334c87c1aa8dfe271e35d14

    • SHA512

      4bdb9c83d251b252ef06c30b28b4f8101aacb2aed8b7c36acd68b96472eb415c1d15f487cc5231f0124ee3a8a3f21ac9dac08b6c1183b1d8afa3f89b329af694

    • SSDEEP

      24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL7DauvgI8+75ST:SnAQqMSPbcBVQej/1INPuLN

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • Contacts a large (3255) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks