Overview

overview

10

Static

static

10

2024-08-22...ry.exe

windows7-x64

10

2024-08-22...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry

  • Size

    215KB

  • Sample

    240822-nqmr7sxepr

  • MD5

    df40d08f46f5fd804a2e22f9a798ec53

  • SHA1

    d7cf4c17b2163db3a83e7d593ca5f5681a39ce62

  • SHA256

    ba29c3e7ac7e8e26bbfa8ab66ad10695379d54b2dfc4a6f6bf323e6b10c5f6ae

  • SHA512

    29bccc4299b597fd23753c3d13f8118ce3bf5589e031dbaf3422cabf16a707d27e82e331a1c91489e682739d235525234150b1933b671edfa1f28a2a8e763840

  • SSDEEP

    6144:S2Kr96kZBp1EvtxFzASUEEa2Xs3T/JKyL:cZBp1EvBzNUEEa2Xs3jJ

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry

    • Size

      215KB

    • MD5

      df40d08f46f5fd804a2e22f9a798ec53

    • SHA1

      d7cf4c17b2163db3a83e7d593ca5f5681a39ce62

    • SHA256

      ba29c3e7ac7e8e26bbfa8ab66ad10695379d54b2dfc4a6f6bf323e6b10c5f6ae

    • SHA512

      29bccc4299b597fd23753c3d13f8118ce3bf5589e031dbaf3422cabf16a707d27e82e331a1c91489e682739d235525234150b1933b671edfa1f28a2a8e763840

    • SSDEEP

      6144:S2Kr96kZBp1EvtxFzASUEEa2Xs3T/JKyL:cZBp1EvBzNUEEa2Xs3jJ

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks