wannacry | bcf60211c20150e31e0f398015197a445b4e380cb88ac9bd55e54a65733f20d0 | Triage

Submit
Reports

Overview

overview

Static

static

3

f2e7f67b49...18.dll

windows7-x64

f2e7f67b49...18.dll

windows10-2004-x64

Sharing

General

Target

f2e7f67b49d06b762f9715fab7ae1645_JaffaCakes118
Size

5.0MB
Sample

240923-xha8wa1cpb
MD5

f2e7f67b49d06b762f9715fab7ae1645
SHA1

e10cf0009b52c01a40a8e41537b7183b869ba58f
SHA256

bcf60211c20150e31e0f398015197a445b4e380cb88ac9bd55e54a65733f20d0
SHA512

7208e4aff183f9482a463001f53fedf1d3bf25af1eedfbc187ba0acdd611bb20e6310ed3ba4492b8aceb56a14cccf8342f33192eee07595d04dbe0201d7ca400
SSDEEP

24576:RbLgurgQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6:RnsQqMSPbcBVQej/1INR

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f2e7f67b49d06b762f9715fab7ae1645_JaffaCakes118.dll

Resource

win7-20240729-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

f2e7f67b49d06b762f9715fab7ae1645_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  f2e7f67b49d06b762f9715fab7ae1645_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  f2e7f67b49d06b762f9715fab7ae1645
- SHA1
  
  e10cf0009b52c01a40a8e41537b7183b869ba58f
- SHA256
  
  bcf60211c20150e31e0f398015197a445b4e380cb88ac9bd55e54a65733f20d0
- SHA512
  
  7208e4aff183f9482a463001f53fedf1d3bf25af1eedfbc187ba0acdd611bb20e6310ed3ba4492b8aceb56a14cccf8342f33192eee07595d04dbe0201d7ca400
- SSDEEP
  
  24576:RbLgurgQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6:RnsQqMSPbcBVQej/1INR
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3117) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy