Overview

overview

10

Static

static

10

2024-03-10...ry.exe

windows7-x64

10

2024-03-10...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-03-10_8c6c723a4839d62780e8761b9513df5b_wannacry

  • Size

    189KB

  • Sample

    240310-z83f6acd9w

  • MD5

    8c6c723a4839d62780e8761b9513df5b

  • SHA1

    3704056af3cc91c56fcca5577a60843a99732e7d

  • SHA256

    279ef35a9f2748763ffa8107d1f6c3cf6d629979ea58403af6b2297f80d9eb72

  • SHA512

    46360c4493ade57dc92112bc59681c0cc787fc192b132cbd8e62bdbbeeb23694c2a112ec2d6fad20e4630a92eaacfbf5444bc817e281fd7da7ff85b43737562d

  • SSDEEP

    3072:lojUMpar9prL/txWwbPCXMoHTXdv14469I6HptMTmshOR9:hrr9pnzbPnoH36HptMphOR

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-03-10_8c6c723a4839d62780e8761b9513df5b_wannacry

    • Size

      189KB

    • MD5

      8c6c723a4839d62780e8761b9513df5b

    • SHA1

      3704056af3cc91c56fcca5577a60843a99732e7d

    • SHA256

      279ef35a9f2748763ffa8107d1f6c3cf6d629979ea58403af6b2297f80d9eb72

    • SHA512

      46360c4493ade57dc92112bc59681c0cc787fc192b132cbd8e62bdbbeeb23694c2a112ec2d6fad20e4630a92eaacfbf5444bc817e281fd7da7ff85b43737562d

    • SSDEEP

      3072:lojUMpar9prL/txWwbPCXMoHTXdv14469I6HptMTmshOR9:hrr9pnzbPnoH36HptMphOR

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Renames multiple (159) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks