Overview

overview

10

Static

static

3

mssecsvc.exe

windows7-x64

10

mssecsvc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a44590f45a959ca1e2f307ca4a9bff7d04645607945bb4674fa0064d778abffb

  • Size

    3.4MB

  • Sample

    250326-hyt9cssms6

  • MD5

    a64a3258a63c9b04470aeffacb2ef571

  • SHA1

    813f0b5c6f02040a0c68d8101b72b97964ab6114

  • SHA256

    a44590f45a959ca1e2f307ca4a9bff7d04645607945bb4674fa0064d778abffb

  • SHA512

    e53093853c91d02558ee99ba346b1699c5e2e477bb7007fef2c9cdebb3458469b80201cbf72994c263d4793a286a6fd9450d883375da2dc063193451e92f8147

  • SSDEEP

    98304:IBJ/hnz5SDPQScpcX6g4IHfTbWObFrrRzquoptU7X:mJh5MPQNcXL4IeOxhzquSu7X

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Targets

    • Target

      mssecsvc.exe

    • Size

      3.6MB

    • MD5

      0c694193ceac8bfb016491ffb534eb7c

    • SHA1

      3afa73283d1e17de1bde6cc14e19417e70fc9554

    • SHA256

      dbf3890b782ac04136c3336814eef97e3c0f4133f9592e882c131c179161b27b

    • SHA512

      bfa729e9449c0a438cfb51fc9f4314022b2f18092938fd42702a06246edc865db77327399a8d21cc1fa208a99e3436e4a460cb010e428caddc638c3fa6547afb

    • SSDEEP

      98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Cxcxk3ZAEUadzR8yc4HI

    Score
    10/10
    wannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Wannacry family

      wannacry

    • Contacts a large (3128) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks