General

  • Target

    2024-03-01_f5775859692402b847a08126e2c9ce18_destroyer_wannacry

  • Size

    27KB

  • Sample

    240301-jjcansee46

  • MD5

    f5775859692402b847a08126e2c9ce18

  • SHA1

    4342a4c02d19d72bd37a45c70448abb62b837521

  • SHA256

    df1bf8e557ea8c64563effad6212a0c17288ba23b747982a02f10775a5187313

  • SHA512

    458f953279e2394b246cafa30984ce6cb823b0063458f7370978188a0936ac3b94ab604845b9e6e3d7075c88918f138232157b5791f1f92600c1fb85a76e2e58

  • SSDEEP

    384:htWZPzzxAm1voDqclh71+k/zxBSKrKBlhOy5o91TaNoD82vz:I7zxAm8qclhgk/26Oho9dUQ82L

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Targets

    • Target

      2024-03-01_f5775859692402b847a08126e2c9ce18_destroyer_wannacry

    • Size

      27KB

    • MD5

      f5775859692402b847a08126e2c9ce18

    • SHA1

      4342a4c02d19d72bd37a45c70448abb62b837521

    • SHA256

      df1bf8e557ea8c64563effad6212a0c17288ba23b747982a02f10775a5187313

    • SHA512

      458f953279e2394b246cafa30984ce6cb823b0063458f7370978188a0936ac3b94ab604845b9e6e3d7075c88918f138232157b5791f1f92600c1fb85a76e2e58

    • SSDEEP

      384:htWZPzzxAm1voDqclh71+k/zxBSKrKBlhOy5o91TaNoD82vz:I7zxAm8qclhgk/26Oho9dUQ82L

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Detects executables containing many references to VEEAM. Observed in ransomware

    • Renames multiple (171) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks