General

  • Target

    2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry

  • Size

    90KB

  • Sample

    240323-x6jvxsbc54

  • MD5

    68a7df17272b831cfc66c1032c32facf

  • SHA1

    dea12fb894f88ed6c905ca56b424252909d91c24

  • SHA256

    4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d

  • SHA512

    d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25

  • SSDEEP

    384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt

Ransom Note
All of your files have been encrypted. Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software. This software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is $50. Payment can be made in Bitcoin (Bitcoin Address: bc1qakhl8eu20ely220fxm6d3tjsk2al64vrha4sxa), Ethereum (ETH Address: 0x22D2C1C38b3c26C9E403B34ea5aF42Af00e90d9f), Binance Coin (BNB Address: bnb17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV0205gfc6ykk), or through PayPal (Burner Account: [email protected]). You can make the payment directly by visiting this PayPal site: PayPal Payment Site. How do I pay, where do I get Bitcoin, Ethereum, Binance Coin, or PayPal? Purchasing Bitcoin, Ethereum, or Binance Coin varies from country to country, you are best advised to do a quick Google search yourself to find out how to buy Bitcoin, Ethereum, Binance Coin, or set up a PayPal account. These sites will help you to get fast and reliable Bitcoin, Ethereum, Binance Coin, or PayPal. Coinmama - https://www.coinmama.com Bitpanda - https://www.bitpanda.com If you will try to seek for help or advice we recommend not to. Why you ask? Because no other software can decrypt this ransomware, only us have the special key to unlock it. So getting other decrypters will be worthless. Don't even think about calling the cops; we will snitch about your pedo activity! You have exactly 12 hours from now to pay up or your PC will be locked for a very long time, approximately 125 Years! Have fun buddy. We monitor every move you make, 👁️‍🗨️ with 8 eyes on you, always one step ahead 👁️, lurking in your devices.
URLs

https://www.coinmama.com

https://www.bitpanda.com

Targets

    • Target

      2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry

    • Size

      90KB

    • MD5

      68a7df17272b831cfc66c1032c32facf

    • SHA1

      dea12fb894f88ed6c905ca56b424252909d91c24

    • SHA256

      4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d

    • SHA512

      d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25

    • SSDEEP

      384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks