wannacry | 0fad304d3f2651eb3978f2ee99cb9d2de3b34696780b0d5f0991eca03ef81725 | Triage

Submit
Reports

Overview

overview

Static

static

3

f375b7c1c9...18.dll

windows7-x64

f375b7c1c9...18.dll

windows10-2004-x64

Sharing

General

Target

f375b7c1c976f31b3240c66813994ae6_JaffaCakes118
Size

5.0MB
Sample

240924-mq1tds1gjl
MD5

f375b7c1c976f31b3240c66813994ae6
SHA1

d0f2c40644d44614c4e8491ab20ae658f554690f
SHA256

0fad304d3f2651eb3978f2ee99cb9d2de3b34696780b0d5f0991eca03ef81725
SHA512

4b245cb9fdbc0e4fab885aaf5715d090eef805b5dd8d5daca48f9eb4e9262527d76c82af2289f9a680be477f2dbacefac3e55c33a3337839e86768918664cc3f
SSDEEP

24576:zbLgddQhfdmMSirYbcMNgef0QeQjG/D8kI1LJMfcH9PO6Lvp9d:znAQqMSPbcBVQej/yxJM0H9nF

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f375b7c1c976f31b3240c66813994ae6_JaffaCakes118.dll

Resource

win7-20240708-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

f375b7c1c976f31b3240c66813994ae6_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  f375b7c1c976f31b3240c66813994ae6_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  f375b7c1c976f31b3240c66813994ae6
- SHA1
  
  d0f2c40644d44614c4e8491ab20ae658f554690f
- SHA256
  
  0fad304d3f2651eb3978f2ee99cb9d2de3b34696780b0d5f0991eca03ef81725
- SHA512
  
  4b245cb9fdbc0e4fab885aaf5715d090eef805b5dd8d5daca48f9eb4e9262527d76c82af2289f9a680be477f2dbacefac3e55c33a3337839e86768918664cc3f
- SSDEEP
  
  24576:zbLgddQhfdmMSirYbcMNgef0QeQjG/D8kI1LJMfcH9PO6Lvp9d:znAQqMSPbcBVQej/yxJM0H9nF
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3314) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy