wannacry | 9537f9d6f2d7a3baae2fb6f26ff449ee3c65185a1b6f9b0e4a3391ada83e0323 | Triage

Submit
Reports

Overview

overview

Static

static

3

fff36f3614...18.dll

windows7-x64

fff36f3614...18.dll

windows10-2004-x64

Sharing

General

Target

fff36f361482680f3255a78ba3ba0095_JaffaCakes118
Size

5.0MB
Sample

240930-exkfzssdmb
MD5

fff36f361482680f3255a78ba3ba0095
SHA1

1d943be263aa43911ef20a100f77add5d7bb320f
SHA256

9537f9d6f2d7a3baae2fb6f26ff449ee3c65185a1b6f9b0e4a3391ada83e0323
SHA512

29b9e07a197cb027ab6aafd3e978a52b79e870f90ff47f1e1e4fab5efb59e4f5786470e842e573595d3da13d08e3f97509233a40a40e12399c03c9e4998bdf7d
SSDEEP

98304:d8qPoBhz1aRxcSUDk36SAEdhqYoP3R8yAVp2H:d8qPe1Cxcxk3ZAE4R8yc4H

Score

10^/10

wannacry discovery ransomware worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fff36f361482680f3255a78ba3ba0095_JaffaCakes118.dll

Resource

win7-20240903-en

wannacry discovery ransomware worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

fff36f361482680f3255a78ba3ba0095_JaffaCakes118.dll

Resource

win10v2004-20240802-en

wannacry discovery ransomware worm

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  fff36f361482680f3255a78ba3ba0095_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  fff36f361482680f3255a78ba3ba0095
- SHA1
  
  1d943be263aa43911ef20a100f77add5d7bb320f
- SHA256
  
  9537f9d6f2d7a3baae2fb6f26ff449ee3c65185a1b6f9b0e4a3391ada83e0323
- SHA512
  
  29b9e07a197cb027ab6aafd3e978a52b79e870f90ff47f1e1e4fab5efb59e4f5786470e842e573595d3da13d08e3f97509233a40a40e12399c03c9e4998bdf7d
- SSDEEP
  
  98304:d8qPoBhz1aRxcSUDk36SAEdhqYoP3R8yAVp2H:d8qPe1Cxcxk3ZAE4R8yc4H
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (3344) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm

© 2018-2024

Terms | Privacy