wannacry | 466f166d55d8755f3b2f77b3150493e7a255207f6ea8d605cc181b16fb3b6d13 | Triage

Submit
Reports

Overview

overview

Static

static

3

fc6d185cdc...18.dll

windows7-x64

fc6d185cdc...18.dll

windows10-2004-x64

Resubmissions

28-09-2024 13:56

240928-q8x21aygnr 10

28-09-2024 13:47

240928-q3nals1gjg 10

Sharing

General

Target

fc6d185cdc6364146888277e411fbf7a_JaffaCakes118
Size

5.0MB
Sample

240928-q3nals1gjg
MD5

fc6d185cdc6364146888277e411fbf7a
SHA1

1a45cb794dae0c3d7dee4c94891ccc2b1706de65
SHA256

466f166d55d8755f3b2f77b3150493e7a255207f6ea8d605cc181b16fb3b6d13
SHA512

a9fe75a5f809b7b19803828eda187d8ca96555581ed718d470c9387f8cab9f32601c85554f7b7483565b1b9bf0a0656cc448b016d6fbfb255bbc7e11e5dc7984
SSDEEP

98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8y:d8qPe1Cxcxk3ZAEUadzR8y

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fc6d185cdc6364146888277e411fbf7a_JaffaCakes118.dll

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

fc6d185cdc6364146888277e411fbf7a_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  fc6d185cdc6364146888277e411fbf7a_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  fc6d185cdc6364146888277e411fbf7a
- SHA1
  
  1a45cb794dae0c3d7dee4c94891ccc2b1706de65
- SHA256
  
  466f166d55d8755f3b2f77b3150493e7a255207f6ea8d605cc181b16fb3b6d13
- SHA512
  
  a9fe75a5f809b7b19803828eda187d8ca96555581ed718d470c9387f8cab9f32601c85554f7b7483565b1b9bf0a0656cc448b016d6fbfb255bbc7e11e5dc7984
- SSDEEP
  
  98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8y:d8qPe1Cxcxk3ZAEUadzR8y
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3241) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy