Behavioral task
behavioral1
Sample
2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry
-
Size
291KB
-
MD5
57099c6158c0aa97503a9c27243352a9
-
SHA1
845d6af54e4adfefb4d41c8163fd267149a8eede
-
SHA256
f813c628d489e6da2a57ac1ef6c4152382f810ffe3e19ac2c296c7a26b5a6a99
-
SHA512
5c912fe51e9d0d5b5e2c8d50933dc82b7fdaed2f4c12b83c67b0dc8d50f36af9d0a00ff060c1528dd08f6c6a3f6f7c42d674b7a4d3e7e98f419f1352c2afe200
-
SSDEEP
6144:sRr9JniaNck2r4EARGbZT5q6IAMun3BjuApIVFyAyABZn14UcfV426wsyijk:s9iaWk2XARw5qFAMun8ApIVFyLAY
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry
Files
-
2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 288KB - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ