Overview

overview

10

Static

static

10

2024-07-28...ry.exe

windows7-x64

10

2024-07-28...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-28_664147001ab4d76f6de68a5112e16aea_wannacry

  • Size

    4.3MB

  • Sample

    240728-h7r6csycle

  • MD5

    664147001ab4d76f6de68a5112e16aea

  • SHA1

    7fde25b1bf73a53bc531f67974980b01168c50dd

  • SHA256

    c6900895311a8bbcdbc36821e05112f7effba6eaa768526ab0c941c7041f071e

  • SHA512

    f249440c418eaa3ad061f64e4048203427549a55f06e00411169d93de8ca3dcab433b9fb9dd09240b7f1db9396a82e92dceb37bfdfe465be4fbc51c07df20def

  • SSDEEP

    49152:wNbV9T1iQXYMP39qD3nB9kbIImcF7vTZJnP:w

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-07-28_664147001ab4d76f6de68a5112e16aea_wannacry

    • Size

      4.3MB

    • MD5

      664147001ab4d76f6de68a5112e16aea

    • SHA1

      7fde25b1bf73a53bc531f67974980b01168c50dd

    • SHA256

      c6900895311a8bbcdbc36821e05112f7effba6eaa768526ab0c941c7041f071e

    • SHA512

      f249440c418eaa3ad061f64e4048203427549a55f06e00411169d93de8ca3dcab433b9fb9dd09240b7f1db9396a82e92dceb37bfdfe465be4fbc51c07df20def

    • SSDEEP

      49152:wNbV9T1iQXYMP39qD3nB9kbIImcF7vTZJnP:w

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks