Overview

overview

10

Static

static

10

2024-07-28...ry.exe

windows7-x64

10

2024-07-28...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry

  • Size

    24KB

  • Sample

    240728-y5jdfasenl

  • MD5

    0bc7112ee4755de56b7fb22758e47182

  • SHA1

    bb2d11065ada048f80786deb072fbdbc265415a0

  • SHA256

    95eaf7092864e622c9bca0a5a3339480d03adaf19f069f5419de52c8f7f75a69

  • SHA512

    846a28920edae418648c09e24680d459b74f9a2a7ca02ddf06ee51bd6a7c34afb86b02b7aff615fda749acbdce0f4388801e4e25360737cad6bd05d320a9fed9

  • SSDEEP

    384:9YenjLLAvOGnLR1TYZdiI8YSxswOVp91kodUxDGg:MmGLHTYZ36c9zmxDb

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry

    • Size

      24KB

    • MD5

      0bc7112ee4755de56b7fb22758e47182

    • SHA1

      bb2d11065ada048f80786deb072fbdbc265415a0

    • SHA256

      95eaf7092864e622c9bca0a5a3339480d03adaf19f069f5419de52c8f7f75a69

    • SHA512

      846a28920edae418648c09e24680d459b74f9a2a7ca02ddf06ee51bd6a7c34afb86b02b7aff615fda749acbdce0f4388801e4e25360737cad6bd05d320a9fed9

    • SSDEEP

      384:9YenjLLAvOGnLR1TYZdiI8YSxswOVp91kodUxDGg:MmGLHTYZ36c9zmxDb

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks