Resubmissions

20-09-2024 01:06

240920-bf79ya1anh 10

20-09-2024 00:42

240920-a2lgmazcpg 10

General

  • Target

    2024-09-20_c47451e9db6bc856051f49f728e05e27_wannacry

  • Size

    230KB

  • Sample

    240920-a2lgmazcpg

  • MD5

    c47451e9db6bc856051f49f728e05e27

  • SHA1

    3a6eae645c5c44ed2933aed3379ae6f7e1ab8331

  • SHA256

    a29f7f16177b1aed8ad6b56dbe19763b9264734304cfc3db9b5c3ce77ea1e08f

  • SHA512

    7a85e7bc7be2f71f799b918bd42dfbc6043ef6222b12ff6b7258bfeeadb38c4f3186ece742a589aa224292749fa66089faca161248b15793ae1a93975bde586a

  • SSDEEP

    6144:QYr9AxLsirVD0GfhyvOhBpC81xmjuQmDbjoYl5m:ULNVDbfhygC81xFBDbj7m

Malware Config

Targets

    • Target

      2024-09-20_c47451e9db6bc856051f49f728e05e27_wannacry

    • Size

      230KB

    • MD5

      c47451e9db6bc856051f49f728e05e27

    • SHA1

      3a6eae645c5c44ed2933aed3379ae6f7e1ab8331

    • SHA256

      a29f7f16177b1aed8ad6b56dbe19763b9264734304cfc3db9b5c3ce77ea1e08f

    • SHA512

      7a85e7bc7be2f71f799b918bd42dfbc6043ef6222b12ff6b7258bfeeadb38c4f3186ece742a589aa224292749fa66089faca161248b15793ae1a93975bde586a

    • SSDEEP

      6144:QYr9AxLsirVD0GfhyvOhBpC81xmjuQmDbjoYl5m:ULNVDbfhygC81xFBDbj7m

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks