Behavioral task
behavioral1
Sample
2024-02-19_a9282aaf372aae86092f21917022850c_wannacry.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-19_a9282aaf372aae86092f21917022850c_wannacry.exe
Resource
win10v2004-20231215-en
General
-
Target
240219-kqmwesbe6x_pw_infected.zip
-
Size
241KB
-
MD5
aa1504b2837acbcdb723e96ae63763e9
-
SHA1
e0200905774c8919105ce42a66ae2e9688d79719
-
SHA256
334081064208e3e430479877e6a730d9458073388422ad7d9da8084c41c38ff9
-
SHA512
c5f0d31f14c88a81a490984926715bb984fdd8a8f895c049a2709b65c908a5a08e62c080bcb494004482ac8c6ccab3dc8abeb4049cdd8c6d0fc34c1c5d54e28c
-
SSDEEP
3072:imKvYfgp0mrewhOBEBmvbhw/QKxKzfAO5q1DLgtBtrMbE/0PRdO5E2+qZT+gNiQH:iFcgpHbVU1wcAOQ1DmSPXwE2+qAsd7N
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/2024-02-19_a9282aaf372aae86092f21917022850c_wannacry family_chaos -
Chaos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2024-02-19_a9282aaf372aae86092f21917022850c_wannacry
Files
-
240219-kqmwesbe6x_pw_infected.zip.zip
Password: infected
-
2024-02-19_a9282aaf372aae86092f21917022850c_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 465KB - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ