Overview

overview

10

Static

static

10

2024-05-29...ry.exe

windows7-x64

10

2024-05-29...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-29_4e1905b74d6a10691f9870a556e94352_destroyer_wannacry

  • Size

    90KB

  • Sample

    240529-1b2c9sbc32

  • MD5

    4e1905b74d6a10691f9870a556e94352

  • SHA1

    9dea42f963b0a6b6225114135efdc58858af542d

  • SHA256

    6d250bb3c8afd3008acb767436e25e13848c581ea0a54cb6da5ae3b496244b6d

  • SHA512

    40d4553824e58332a4a516a4bcc7196a5a3d0773dc62ba47539a1ce01a0fd36ae031247e70bbfcdff2943b6551194e5340ca514af2f6411189d9c4ad30dbd9c2

  • SSDEEP

    1536:XNslozFe60q9unSAQFnikOP9ywRnxTadMr+jtMvRMWKoyIsXUl22qh:c60q9wSAYni79ywBVatjtMBKdIlg

Score
10/10
chaospersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-05-29_4e1905b74d6a10691f9870a556e94352_destroyer_wannacry

    • Size

      90KB

    • MD5

      4e1905b74d6a10691f9870a556e94352

    • SHA1

      9dea42f963b0a6b6225114135efdc58858af542d

    • SHA256

      6d250bb3c8afd3008acb767436e25e13848c581ea0a54cb6da5ae3b496244b6d

    • SHA512

      40d4553824e58332a4a516a4bcc7196a5a3d0773dc62ba47539a1ce01a0fd36ae031247e70bbfcdff2943b6551194e5340ca514af2f6411189d9c4ad30dbd9c2

    • SSDEEP

      1536:XNslozFe60q9unSAQFnikOP9ywRnxTadMr+jtMvRMWKoyIsXUl22qh:c60q9wSAYni79ywBVatjtMBKdIlg

    Score
    10/10
    chaospersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Detects executables containing many references to VEEAM. Observed in ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks