Overview

overview

10

Static

static

10

2024-03-25...ry.exe

windows7-x64

10

2024-03-25...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry

  • Size

    291KB

  • Sample

    240325-gb7eqscb7w

  • MD5

    57099c6158c0aa97503a9c27243352a9

  • SHA1

    845d6af54e4adfefb4d41c8163fd267149a8eede

  • SHA256

    f813c628d489e6da2a57ac1ef6c4152382f810ffe3e19ac2c296c7a26b5a6a99

  • SHA512

    5c912fe51e9d0d5b5e2c8d50933dc82b7fdaed2f4c12b83c67b0dc8d50f36af9d0a00ff060c1528dd08f6c6a3f6f7c42d674b7a4d3e7e98f419f1352c2afe200

  • SSDEEP

    6144:sRr9JniaNck2r4EARGbZT5q6IAMun3BjuApIVFyAyABZn14UcfV426wsyijk:s9iaWk2XARw5qFAMun8ApIVFyLAY

Score
10/10
chaosevasionransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-03-25_57099c6158c0aa97503a9c27243352a9_wannacry

    • Size

      291KB

    • MD5

      57099c6158c0aa97503a9c27243352a9

    • SHA1

      845d6af54e4adfefb4d41c8163fd267149a8eede

    • SHA256

      f813c628d489e6da2a57ac1ef6c4152382f810ffe3e19ac2c296c7a26b5a6a99

    • SHA512

      5c912fe51e9d0d5b5e2c8d50933dc82b7fdaed2f4c12b83c67b0dc8d50f36af9d0a00ff060c1528dd08f6c6a3f6f7c42d674b7a4d3e7e98f419f1352c2afe200

    • SSDEEP

      6144:sRr9JniaNck2r4EARGbZT5q6IAMun3BjuApIVFyAyABZn14UcfV426wsyijk:s9iaWk2XARw5qFAMun8ApIVFyLAY

    Score
    10/10
    chaosevasionransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Detects command variations typically used by ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks