Overview

overview

10

Static

static

3

ff14280269...18.exe

windows7-x64

10

ff14280269...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff14280269718d80db5523a530f51e18_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240929-wmx3rsthkr

  • MD5

    ff14280269718d80db5523a530f51e18

  • SHA1

    c754c2bf56377aaa38ff48b3bcbde724a889ec1d

  • SHA256

    c714413463d40061b3f07ec6cdfde55eac91fc91ae96bc38ac8adabe74ce1a15

  • SHA512

    5b7b6bfc97c5afdde26a1f296101de39a0f2148f6ec95ae461b40e1ff2082d420d4db076705e306f7aa5755a3f8c53ea8ef6e222905dbf9495a719279ad7d795

  • SSDEEP

    49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      ff14280269718d80db5523a530f51e18_JaffaCakes118

    • Size

      3.6MB

    • MD5

      ff14280269718d80db5523a530f51e18

    • SHA1

      c754c2bf56377aaa38ff48b3bcbde724a889ec1d

    • SHA256

      c714413463d40061b3f07ec6cdfde55eac91fc91ae96bc38ac8adabe74ce1a15

    • SHA512

      5b7b6bfc97c5afdde26a1f296101de39a0f2148f6ec95ae461b40e1ff2082d420d4db076705e306f7aa5755a3f8c53ea8ef6e222905dbf9495a719279ad7d795

    • SSDEEP

      49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Contacts a large (3240) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks