General
-
Target
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry
-
Size
90KB
-
Sample
240323-x6jvxsbc54
-
MD5
68a7df17272b831cfc66c1032c32facf
-
SHA1
dea12fb894f88ed6c905ca56b424252909d91c24
-
SHA256
4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d
-
SHA512
d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25
-
SSDEEP
384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN
Behavioral task
behavioral1
Sample
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt
https://www.coinmama.com
https://www.bitpanda.com
Targets
-
-
Target
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry
-
Size
90KB
-
MD5
68a7df17272b831cfc66c1032c32facf
-
SHA1
dea12fb894f88ed6c905ca56b424252909d91c24
-
SHA256
4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d
-
SHA512
d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25
-
SSDEEP
384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-