wannacry | 43704ad4b343ba301fceec626cbba9a1f7dadf160523ef0acbbaa9714dfce61d | Triage

Submit
Reports

Overview

overview

Static

static

3

fcb6b0f958...18.dll

windows7-x64

fcb6b0f958...18.dll

windows10-2004-x64

Sharing

General

Target

fcb6b0f95853dfda72d5535a424b3a29_JaffaCakes118
Size

5.0MB
Sample

240928-t6wmyawaml
MD5

fcb6b0f95853dfda72d5535a424b3a29
SHA1

2bac7f4fc74791cd670ea80448857fa49c9d8904
SHA256

43704ad4b343ba301fceec626cbba9a1f7dadf160523ef0acbbaa9714dfce61d
SHA512

3b3ff7e0e6dd3ffbebe0346068aab8560730d8674fc3f9edeb79e704d312a0a6d873f778eb37af7e2992fe822e192cf8be377870f2c47dd075325e0c0a7b9377
SSDEEP

12288:T1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFh:RbLguripdmMSirYbcMNgef0QeQjG

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fcb6b0f95853dfda72d5535a424b3a29_JaffaCakes118.dll

Resource

win7-20240708-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

fcb6b0f95853dfda72d5535a424b3a29_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  fcb6b0f95853dfda72d5535a424b3a29_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  fcb6b0f95853dfda72d5535a424b3a29
- SHA1
  
  2bac7f4fc74791cd670ea80448857fa49c9d8904
- SHA256
  
  43704ad4b343ba301fceec626cbba9a1f7dadf160523ef0acbbaa9714dfce61d
- SHA512
  
  3b3ff7e0e6dd3ffbebe0346068aab8560730d8674fc3f9edeb79e704d312a0a6d873f778eb37af7e2992fe822e192cf8be377870f2c47dd075325e0c0a7b9377
- SSDEEP
  
  12288:T1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFh:RbLguripdmMSirYbcMNgef0QeQjG
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3244) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy