General
- Target 2024-03-20_6f014d20774a7ec9869e54fe3d977f11_wannacry
- Size 127KB
- Sample240320-gm124aaa48
- SHA256 3688345fc9eaee1073bfb24872d397a180a784e263b7a3b0ef91a8cd2bdad747
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\Adobe\Updater6\read_it.txt
Ransom Note
- Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)
Targets
-
- Target 2024-03-20_6f014d20774a7ec9869e54fe3d977f11_wannacry
- Size 127KB
- SHA256 3688345fc9eaee1073bfb24872d397a180a784e263b7a3b0ef91a8cd2bdad747
Score10/10Chaos
Ransomware family first seen in June 2021.
Chaos Ransomware
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Detects command variations typically used by ransomware
Detects executables containing many references to VEEAM. Observed in ransomware
Modifies boot configuration data using bcdedit
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Drops desktop.ini file(s)
Sets desktop wallpaper using registry