Overview

overview

10

Static

static

10

2024-09-08...ry.exe

windows7-x64

10

2024-09-08...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-08_99e391acbfc6d91858ab048423b1a90a_wannacry

  • Size

    120KB

  • Sample

    240908-kh38fawdqm

  • MD5

    99e391acbfc6d91858ab048423b1a90a

  • SHA1

    3eec5857d841d4e31f70c53c8ebdfb6b4bfc0999

  • SHA256

    1ba44b6e1caaed12c97316faf50d58ab0aefc7061150fa7ede47c9baddd1e753

  • SHA512

    5c0d69a228a80cc04459d7edaacc7abd8f69c4888ed0576390212aa383604adb2cb0854ac0072a27a8734bb350b44ecf7ea7fccd8f6d782d517f2df1e44064b0

  • SSDEEP

    1536:Ho2C1A03r9kX9kQjXpHyNXBj1fRRdsVJvywKyLDTV:Ho603r9kX97zpS91LRKVJvzKyL

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-09-08_99e391acbfc6d91858ab048423b1a90a_wannacry

    • Size

      120KB

    • MD5

      99e391acbfc6d91858ab048423b1a90a

    • SHA1

      3eec5857d841d4e31f70c53c8ebdfb6b4bfc0999

    • SHA256

      1ba44b6e1caaed12c97316faf50d58ab0aefc7061150fa7ede47c9baddd1e753

    • SHA512

      5c0d69a228a80cc04459d7edaacc7abd8f69c4888ed0576390212aa383604adb2cb0854ac0072a27a8734bb350b44ecf7ea7fccd8f6d782d517f2df1e44064b0

    • SSDEEP

      1536:Ho2C1A03r9kX9kQjXpHyNXBj1fRRdsVJvywKyLDTV:Ho603r9kX97zpS91LRKVJvzKyL

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks