Behavioral task
behavioral1
Sample
2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry
-
Size
31KB
-
MD5
7ac66cd243c6782f8e11680398bf7fc9
-
SHA1
8a64f2ae6b6529f761a606eca390f28e958564ff
-
SHA256
1d697c827da729fceea49235066a4a711f473d9b9ad04971977db97aa0b7bd34
-
SHA512
ddc59db33aa6d9b5fdbc78cb24de64ec0d9a4de9681dc55ac702cdf917f27888c17cf7a7e837e74eacadaf6b4e35df80661849026868bf7e8744b29ffaddc25c
-
SSDEEP
384:ytWZPzzxAm1vIJ5ZQomFVdeOeTbzyvQC/JpcllOy5o91fgnpu82vm:X7zxAmWDuXdreKQuJWho9CA82u
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry
Files
-
2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ