Behavioral task
behavioral1
Sample
2024-02-17_22c442d48aa7c9f9d35eecd0666dea14_wannacry.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-17_22c442d48aa7c9f9d35eecd0666dea14_wannacry.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-17_22c442d48aa7c9f9d35eecd0666dea14_wannacry
-
Size
317KB
-
MD5
22c442d48aa7c9f9d35eecd0666dea14
-
SHA1
a1fdc523787aa5c068613867d0b6c27ee40b70e1
-
SHA256
8d20fefdcc204570b0d19b26fd99553ea89697b3646073b769466aa8ac5fc730
-
SHA512
1d8705708afeccaaaf467d6466d0dbaa6097b2942c7b45c548175c17b771182e89c7557175b8d830ae9e721471aad20ce0902d6861ab3bb9c35a1cf334f2a308
-
SSDEEP
1536:Ho2jYNMNXr9MaAQ/e9rh12xwpUlwhNNxI5/fbBIGbtGutFnL5iU66tDwU1yw+TN+:HojMNXr9MaAQ/eH6wp2wjW/jIIv
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-17_22c442d48aa7c9f9d35eecd0666dea14_wannacry
Files
-
2024-02-17_22c442d48aa7c9f9d35eecd0666dea14_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ