Overview

overview

10

Static

static

10

2024-06-01...ry.exe

windows7-x64

10

2024-06-01...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry

  • Size

    88KB

  • Sample

    240601-2n8tjshd8z

  • MD5

    c90a4499699ec433aca47efd8f442b7e

  • SHA1

    526fa785605031ccc1f6c7e1b15c61bc63a23f1b

  • SHA256

    d8165252f798066d1d08a2265a07324611cba08f163c5810ea5c84c25ae914a1

  • SHA512

    a2051d5442672347039c7bdcef35d430dd7d7266b05e1163ea270aeac0aab139840cb5eaf3f21fa180baede19a775c7b76bb867e1a8e87d6b4ffa61b15b69b37

  • SSDEEP

    1536:Do2hGMBAr92VmK4lkRyYm4jR0irfNe+NaEK/4UIsawfhlcolZ2zxhUYQu:DoYGMBAr92Vm9lkjm4VL7pgfayoO0zE8

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-06-01_c90a4499699ec433aca47efd8f442b7e_destroyer_wannacry

    • Size

      88KB

    • MD5

      c90a4499699ec433aca47efd8f442b7e

    • SHA1

      526fa785605031ccc1f6c7e1b15c61bc63a23f1b

    • SHA256

      d8165252f798066d1d08a2265a07324611cba08f163c5810ea5c84c25ae914a1

    • SHA512

      a2051d5442672347039c7bdcef35d430dd7d7266b05e1163ea270aeac0aab139840cb5eaf3f21fa180baede19a775c7b76bb867e1a8e87d6b4ffa61b15b69b37

    • SSDEEP

      1536:Do2hGMBAr92VmK4lkRyYm4jR0irfNe+NaEK/4UIsawfhlcolZ2zxhUYQu:DoYGMBAr92Vm9lkjm4VL7pgfayoO0zE8

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Detects command variations typically used by ransomware

    • Renames multiple (184) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks