Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2023-02-02...ry.exe

windows7-x64

10

2023-02-02...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-02-02_71c3a6f87a5c67593fd199a0fbc146bf_wannacry.exe

  • Size

    517KB

  • Sample

    230203-jjn98scg32

  • MD5

    71c3a6f87a5c67593fd199a0fbc146bf

  • SHA1

    30dd047751e21b57f6c08a56b21580f44dd9f437

  • SHA256

    98e6fe0dfa72dfd322bfbddc7bdd6813f339fc3d88bccb2dbc2ed6cb487b90e4

  • SHA512

    21a5c616b8b9455409a76496bb91b131921018685d6de7f8b92712bcf7f1b8043049ae5591875c27d4ec04b52fd4be5931e70afb7b571b4b6302ec6cda2bf848

  • SSDEEP

    12288:Xw9Rt0RPnRrcA0Sqg9bIFX7O5rBVOxZ3:0aVDbI5Or4

Score
10/10
chaosevasionransomwarespywarestealer

Malware Config

Targets

    • Target

      2023-02-02_71c3a6f87a5c67593fd199a0fbc146bf_wannacry.exe

    • Size

      517KB

    • MD5

      71c3a6f87a5c67593fd199a0fbc146bf

    • SHA1

      30dd047751e21b57f6c08a56b21580f44dd9f437

    • SHA256

      98e6fe0dfa72dfd322bfbddc7bdd6813f339fc3d88bccb2dbc2ed6cb487b90e4

    • SHA512

      21a5c616b8b9455409a76496bb91b131921018685d6de7f8b92712bcf7f1b8043049ae5591875c27d4ec04b52fd4be5931e70afb7b571b4b6302ec6cda2bf848

    • SSDEEP

      12288:Xw9Rt0RPnRrcA0Sqg9bIFX7O5rBVOxZ3:0aVDbI5Or4

    Score
    10/10
    chaosevasionransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks