Behavioral task
behavioral1
Sample
2024-04-12_df1ce61fb4869963a1e95a917adef9d0_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-12_df1ce61fb4869963a1e95a917adef9d0_wannacry.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-12_df1ce61fb4869963a1e95a917adef9d0_wannacry
-
Size
111KB
-
MD5
df1ce61fb4869963a1e95a917adef9d0
-
SHA1
bcf132651a5bd948e758441e4733519d1502c8bf
-
SHA256
e58bf0a81866c21e25dbe8f85fd74304259be3e1b53019f857c2354e23f71b1e
-
SHA512
d2867e1b00900098674f1a87653a9f016911649162c66f0eab67336f758a6611a497bc21a6cbe336bbc2464212bfec59e991b99aa92777ad2250e72b4e17888b
-
SSDEEP
3072:CB7q9NKEXUrQlGRSAMHsEwGYMl9AYGywOjvOjJ:CB7q9CQ8hMs7GpKPOaj
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-12_df1ce61fb4869963a1e95a917adef9d0_wannacry
Files
-
2024-04-12_df1ce61fb4869963a1e95a917adef9d0_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ