General
-
Target
2024-05-10_43fce97387e88b378f7bfcbb3152cc70_destroyer_wannacry
-
Size
26KB
-
Sample
240510-w2bhbaah7s
-
MD5
43fce97387e88b378f7bfcbb3152cc70
-
SHA1
f3aaa47fe088f0d06a34223122675f0388835f18
-
SHA256
88da5622398543b2c393dae6bd7d4c507046bf96534f8ef3ef153ca45aa32fa1
-
SHA512
400254b59d01abbb8fdbcabd3e29c1a9ab8ced95f312729e7d70ca2978329a1c9ce413c1d4eb3c11f540f659aefb22fe382374203586cce86abf24ac827e227b
-
SSDEEP
384:ZtWZPzzxAm1vMMtgTQ22r7OUmgcYfdQPq5lROy5o91yvVAE82vp:A7zxAmN+MFrEgcYwiho90H82B
Malware Config
Targets
-
-
Target
2024-05-10_43fce97387e88b378f7bfcbb3152cc70_destroyer_wannacry
-
Size
26KB
-
MD5
43fce97387e88b378f7bfcbb3152cc70
-
SHA1
f3aaa47fe088f0d06a34223122675f0388835f18
-
SHA256
88da5622398543b2c393dae6bd7d4c507046bf96534f8ef3ef153ca45aa32fa1
-
SHA512
400254b59d01abbb8fdbcabd3e29c1a9ab8ced95f312729e7d70ca2978329a1c9ce413c1d4eb3c11f540f659aefb22fe382374203586cce86abf24ac827e227b
-
SSDEEP
384:ZtWZPzzxAm1vMMtgTQ22r7OUmgcYfdQPq5lROy5o91yvVAE82vp:A7zxAmN+MFrEgcYwiho90H82B
Score10/10-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Detects executables containing many references to VEEAM. Observed in ransomware
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-