Behavioral task
behavioral1
Sample
2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry
-
Size
88KB
-
MD5
c90a4499699ec433aca47efd8f442b7e
-
SHA1
526fa785605031ccc1f6c7e1b15c61bc63a23f1b
-
SHA256
d8165252f798066d1d08a2265a07324611cba08f163c5810ea5c84c25ae914a1
-
SHA512
a2051d5442672347039c7bdcef35d430dd7d7266b05e1163ea270aeac0aab139840cb5eaf3f21fa180baede19a775c7b76bb867e1a8e87d6b4ffa61b15b69b37
-
SSDEEP
1536:Do2hGMBAr92VmK4lkRyYm4jR0irfNe+NaEK/4UIsawfhlcolZ2zxhUYQu:DoYGMBAr92Vm9lkjm4VL7pgfayoO0zE8
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry
Files
-
2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ