Overview

overview

10

Static

static

10

2024-05-04...ry.exe

windows7-x64

10

2024-05-04...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-04_825237535c11ac8b38d3227a9b0d68e4_destroyer_wannacry

  • Size

    47KB

  • Sample

    240504-ydbjhsgg4y

  • MD5

    825237535c11ac8b38d3227a9b0d68e4

  • SHA1

    afb3d9a122d1f9c5149148ead8fdeabc8f065648

  • SHA256

    d139cf9992044e972e139f409f80f7c944ae0e03541fc3fb85f0e78a1ca03440

  • SHA512

    6d9a7953149d979985f470746f0f53d637e85aaaef6d50b0ee2a4af5654677784b13064caab49f51ac1e9497af13b66c36954f10b7def7ecc8f66e57e1970419

  • SSDEEP

    768:NYqo2ycN9EpGkmc1mEnHr9usUMmT/meMFAavvlXRIrpCZ4EFkrY7IB7e5:Zo21X3lEnHr9uymjBavvlXRSCtFaYMBe

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-05-04_825237535c11ac8b38d3227a9b0d68e4_destroyer_wannacry

    • Size

      47KB

    • MD5

      825237535c11ac8b38d3227a9b0d68e4

    • SHA1

      afb3d9a122d1f9c5149148ead8fdeabc8f065648

    • SHA256

      d139cf9992044e972e139f409f80f7c944ae0e03541fc3fb85f0e78a1ca03440

    • SHA512

      6d9a7953149d979985f470746f0f53d637e85aaaef6d50b0ee2a4af5654677784b13064caab49f51ac1e9497af13b66c36954f10b7def7ecc8f66e57e1970419

    • SSDEEP

      768:NYqo2ycN9EpGkmc1mEnHr9usUMmT/meMFAavvlXRIrpCZ4EFkrY7IB7e5:Zo21X3lEnHr9uymjBavvlXRSCtFaYMBe

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Renames multiple (195) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks