Overview

overview

10

Static

static

10

2024-07-08...ry.exe

windows7-x64

10

2024-07-08...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-08_bfc7d2b1138466cf6227670d9f8731ad_destroyer_wannacry

  • Size

    27KB

  • Sample

    240708-bwj72swcnn

  • MD5

    bfc7d2b1138466cf6227670d9f8731ad

  • SHA1

    7bab71576d5f05802cd63876f3e42e489775a9a8

  • SHA256

    ef97bc79042f3929e9e0cc2459f036857a53fee41d673ba54727c5ee219dafc8

  • SHA512

    db41b7923ed6cde870201f4fbe18779165df76510912644c0f4f28c29bf9aad1867a4316c08118ad32f094569d4ba5720a70295b7351899a2a3d038a1d473283

  • SSDEEP

    384:AmtWZPzzxAm1vAddehhvLKe21GS2NiNWllOy5o91Qd7aNI82vl:Ar7zxAmIde3ee2ISSigho9M7aa82t

Score
10/10
chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-07-08_bfc7d2b1138466cf6227670d9f8731ad_destroyer_wannacry

    • Size

      27KB

    • MD5

      bfc7d2b1138466cf6227670d9f8731ad

    • SHA1

      7bab71576d5f05802cd63876f3e42e489775a9a8

    • SHA256

      ef97bc79042f3929e9e0cc2459f036857a53fee41d673ba54727c5ee219dafc8

    • SHA512

      db41b7923ed6cde870201f4fbe18779165df76510912644c0f4f28c29bf9aad1867a4316c08118ad32f094569d4ba5720a70295b7351899a2a3d038a1d473283

    • SSDEEP

      384:AmtWZPzzxAm1vAddehhvLKe21GS2NiNWllOy5o91Qd7aNI82vl:Ar7zxAmIde3ee2ISSigho9M7aa82t

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (186) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks