General
-
Target
2024-03-04_2a0487a33e6e0251342bb82a0048e0bc_destroyer_wannacry
-
Size
27KB
-
Sample
240304-3eg5xagc8w
-
MD5
2a0487a33e6e0251342bb82a0048e0bc
-
SHA1
c82c1db3ec7557bf99fb3538b6d10f779fe13139
-
SHA256
af6750a2647ba7d580bc524577eff5fb462c030246368ed94e954f9fb133fef3
-
SHA512
31a096bf84a1217a30b75e72eed1d0f9cd4a8f3e0f240f8790419f3a7640cda414a608de2bae802c2d817734965fdd27d09a542c036eac187706fa0a73dd2d40
-
SSDEEP
384:MtWZPzzxAm1vgcbIEhvLKeOS2NiNWlwOy5o91F1x+82vq:x7zxAm9IYeeOSSiNho9JM82i
Behavioral task
behavioral1
Sample
2024-03-04_2a0487a33e6e0251342bb82a0048e0bc_destroyer_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-04_2a0487a33e6e0251342bb82a0048e0bc_destroyer_wannacry.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\ProgramData\Adobe\Updater6\read_it.txt
Targets
-
-
Target
2024-03-04_2a0487a33e6e0251342bb82a0048e0bc_destroyer_wannacry
-
Size
27KB
-
MD5
2a0487a33e6e0251342bb82a0048e0bc
-
SHA1
c82c1db3ec7557bf99fb3538b6d10f779fe13139
-
SHA256
af6750a2647ba7d580bc524577eff5fb462c030246368ed94e954f9fb133fef3
-
SHA512
31a096bf84a1217a30b75e72eed1d0f9cd4a8f3e0f240f8790419f3a7640cda414a608de2bae802c2d817734965fdd27d09a542c036eac187706fa0a73dd2d40
-
SSDEEP
384:MtWZPzzxAm1vgcbIEhvLKeOS2NiNWlwOy5o91F1x+82vq:x7zxAm9IYeeOSSiNho9JM82i
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Detects executables containing many references to VEEAM. Observed in ransomware
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-