Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2024-05-22_731178dd28d3b8ee829fb6ac4d3c065a_wannacry.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_731178dd28d3b8ee829fb6ac4d3c065a_wannacry.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_731178dd28d3b8ee829fb6ac4d3c065a_wannacry
-
Size
323KB
-
MD5
731178dd28d3b8ee829fb6ac4d3c065a
-
SHA1
11c4a6be0a123812b916d4a8eba96857f311d906
-
SHA256
c9bd1abfb6e520d973284f2fbebaf14cd1cf5db7c2e2956e9d4a9b0564547b81
-
SHA512
9d2b61b08b9d1b8503ae647d27d5cf4604dfc81ff2c923933ea3bae473d8a3a4bdfe7032486baf1dfe5a28c51bc1f57a79f07ac289e045087dd9ebbbc870c024
-
SSDEEP
3072:ooy4lr9N4L/mQZt2FWtMB6w31viSYrwCa2CybjDjBJRrrS0n4+3GK2vVort6jbQG:fr9N4LS6MBrYH3vxshzmZ6jO7SV2
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-22_731178dd28d3b8ee829fb6ac4d3c065a_wannacry
Files
-
2024-05-22_731178dd28d3b8ee829fb6ac4d3c065a_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 321KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ