Behavioral task
behavioral1
Sample
2024-04-03_d6ff005837ddd51800c690a4f3d2bb1c_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-03_d6ff005837ddd51800c690a4f3d2bb1c_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-03_d6ff005837ddd51800c690a4f3d2bb1c_wannacry
-
Size
101KB
-
MD5
d6ff005837ddd51800c690a4f3d2bb1c
-
SHA1
1e124e594c3dcaeb796870764c5058e7396b8979
-
SHA256
3ef443961db229c2dd9b90ef7db82eaac674f6da81e43e1d70cad06a0b3a8173
-
SHA512
8d68f941a0cfc8386f18b59e0123b0dc82a1673e4536f4e250c1be2c6fa732e2117183c1e60f860496e2d303ed97bdc12c8be9687d69a6e0d41a7c73bbf216cc
-
SSDEEP
3072:Uh0Qq9r+U/AW8OguUhP+CpiB+BGN4E/TsmSXx:Uh0Qq9Xh8OgRmCpiYQe
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-03_d6ff005837ddd51800c690a4f3d2bb1c_wannacry
Files
-
2024-04-03_d6ff005837ddd51800c690a4f3d2bb1c_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ