General
-
Target
202405243622cd2ae39df938752adbea70509a7ddestroyerwannacry
-
Size
92KB
-
Sample
240525-z1tjaaba82
-
MD5
3622cd2ae39df938752adbea70509a7d
-
SHA1
c2ed856920532a42140299f5ab0c2df35407ab6d
-
SHA256
a5c4ff5dd0782930bae9e58bba41765491f11cbb56651f7cd9452947a86cf168
-
SHA512
692d03005ad496b96cb1931360fa2fa41949bae0eaf2db69a6e454d622c5a409daa07bddbdc8411f630e637554e7bdc1c960351fe68b751f5621492fb2118d7c
-
SSDEEP
1536:9RcrcV9YNJaccMpTrX7YeOzk+7w1m6wVcl:XcrcV9Y/NcMp3vqY
Static task
static1
Behavioral task
behavioral1
Sample
202405243622cd2ae39df938752adbea70509a7ddestroyerwannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
202405243622cd2ae39df938752adbea70509a7ddestroyerwannacry.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
202405243622cd2ae39df938752adbea70509a7ddestroyerwannacry
-
Size
92KB
-
MD5
3622cd2ae39df938752adbea70509a7d
-
SHA1
c2ed856920532a42140299f5ab0c2df35407ab6d
-
SHA256
a5c4ff5dd0782930bae9e58bba41765491f11cbb56651f7cd9452947a86cf168
-
SHA512
692d03005ad496b96cb1931360fa2fa41949bae0eaf2db69a6e454d622c5a409daa07bddbdc8411f630e637554e7bdc1c960351fe68b751f5621492fb2118d7c
-
SSDEEP
1536:9RcrcV9YNJaccMpTrX7YeOzk+7w1m6wVcl:XcrcV9Y/NcMp3vqY
Score9/10-
Renames multiple (120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-