Overview

overview

10

Static

static

10

Malware-da...00.exe

windows7-x64

Malware-da...00.exe

windows10-2004-x64

Malware-da...ws.exe

windows7-x64

6

Malware-da...ws.exe

windows10-2004-x64

6

Malware-da...as.exe

windows7-x64

1

Malware-da...as.exe

windows10-2004-x64

1

Malware-da...ck.exe

windows7-x64

1

Malware-da...ck.exe

windows10-2004-x64

1

Malware-da...V2.exe

windows7-x64

10

Malware-da...V2.exe

windows10-2004-x64

10

Malware-da...er.exe

windows7-x64

1

Malware-da...er.exe

windows10-2004-x64

1

Malware-da...an.exe

windows7-x64

3

Malware-da...an.exe

windows10-2004-x64

1

Malware-da...up.exe

windows7-x64

1

Malware-da...up.exe

windows10-2004-x64

1

Malware-da...nt.exe

windows7-x64

Malware-da...nt.exe

windows10-2004-x64

Malware-da...ye.exe

windows7-x64

Malware-da...ye.exe

windows10-2004-x64

Malware-da...ry.exe

windows7-x64

10

Malware-da...ry.exe

windows10-2004-x64

10

Malware-da...op.exe

windows7-x64

7

Malware-da...op.exe

windows10-2004-x64

7

Resubmissions

27/05/2024, 22:11

240527-14ae9ada4310

27/05/2024, 21:15

240527-z3zhbabd5910

13/02/2024, 12:11

240213-pcwzdshd2w10

13/02/2024, 12:08

240213-pa6qtahc7y10

18/12/2023, 08:13

231218-j4g2nabaf510

05/12/2023, 08:54

231205-kt32taae2710

05/12/2023, 07:41

231205-jjdthahh6w10

05/12/2023, 07:38

231205-jgmcvshh5x10

27/11/2023, 23:37

231127-3mae2adf83

26/11/2023, 09:39

231126-lmxf5agd8710

Sharing

Copy URL Twitter E-mail

General

  • Target
    82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46.zip
  • Size 18.8MB
  • Sample240527-14ae9ada43
  • SHA256 1d3c2088b2d712f8006279db8acb9a1c6dc3037886a655d37bf75ea5fa6b9518
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaoswannacryaspackv2bootkitdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojanworm

Malware Config

Extracted

Path

  • C:\Users\Admin\Documents\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

    • Target
      Malware-database-main/000.exe
    • Size 6.7MB
    • SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2
    • Target
      Malware-database-main/ChilledWindows.exe
    • Size 4.4MB
    • SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      Malware-database-main/Christmas.exe
    • Size 482KB
    • SHA256 cb7c01aa6b8d1f7fa7131d6444a220cedf0c51102c127a13a4313e4249b1f88e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      Malware-database-main/CookieClickerHack.exe
    • Size 68KB
    • SHA256 13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      Malware-database-main/Electron V2.exe
    • Size 39KB
    • SHA256 04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    chaosevasionransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral10behavioral9
    • Target
      Malware-database-main/Flasher.exe
    • Size 246KB
    • SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Malware-database-main/MEMZ Trojan.exe
    • Size 12KB
    • SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13behavioral14
    • Target
      Malware-database-main/Popup.exe
    • Size 373KB
    • SHA256 f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Malware-database-main/PowerPoint.exe
    • Size 136KB
    • SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitpersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral17behavioral18
    • Target
      Malware-database-main/RedEye.exe
    • Size 10.6MB
    • SHA256 9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Modifies Windows Firewall

      evasion

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral19behavioral20
    • Target
      Malware-database-main/WannaCry.exe
    • Size 224KB
    • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral21behavioral22
    • Target
      Malware-database-main/butterflyondesktop.exe
    • Size 2.8MB
    • SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral23behavioral24

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

8
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks

static1

aspackv2chaos
Score
10/10

behavioral1

evasionpersistenceransomware
Score
8/10

behavioral2

evasionpersistenceransomware
Score
8/10

behavioral3

Score
6/10

behavioral4

Score
6/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

chaosevasionransomwarespywarestealer
Score
10/10

behavioral10

chaosevasionransomwarespywarestealer
Score
10/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

bootkitpersistence
Score
7/10

behavioral18

bootkitpersistence
Score
7/10

behavioral19

defense_evasionevasionexecutionimpactpersistenceransomwaretrojan
Score
10/10

behavioral20

defense_evasionevasionexecutionimpactpersistenceransomwaretrojan
Score
10/10

behavioral21

wannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral22

wannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm
Score
10/10

behavioral23

Score
7/10

behavioral24

Score
7/10