Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-10-12_b404aee522acd9f67f8294cc0d47bcf2_destroyer_wannacry
-
Size
27KB
-
Sample
241012-rrkk1szbkk
-
MD5
b404aee522acd9f67f8294cc0d47bcf2
-
SHA1
d6addc54e7f550e8c61fdcdc09760fdbd8597395
-
SHA256
52ed0d1f0b61a5ed3531701eea2a7c40c4d5b344fa3b79093e62978aa8f3b0e6
-
SHA512
4648d3f9a50269280d9c3e63bc3d25efcf85ccc75981a09fc0315dcfa67dfebc21a9a9348fcd1c33b5ccb7d45a927a5165d67118dbee65f11ea28eb147de2a38
-
SSDEEP
384:GtWZPzzxAm1vS8BFEWfa2DicsdzCkkxlRvOy5o91EjmX82vr:L7zxAmb62Dimkwvho90282z
Behavioral task
behavioral1
Sample
2024-10-12_b404aee522acd9f67f8294cc0d47bcf2_destroyer_wannacry.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-12_b404aee522acd9f67f8294cc0d47bcf2_destroyer_wannacry.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt
Targets
-
-
Target
2024-10-12_b404aee522acd9f67f8294cc0d47bcf2_destroyer_wannacry
-
Size
27KB
-
MD5
b404aee522acd9f67f8294cc0d47bcf2
-
SHA1
d6addc54e7f550e8c61fdcdc09760fdbd8597395
-
SHA256
52ed0d1f0b61a5ed3531701eea2a7c40c4d5b344fa3b79093e62978aa8f3b0e6
-
SHA512
4648d3f9a50269280d9c3e63bc3d25efcf85ccc75981a09fc0315dcfa67dfebc21a9a9348fcd1c33b5ccb7d45a927a5165d67118dbee65f11ea28eb147de2a38
-
SSDEEP
384:GtWZPzzxAm1vS8BFEWfa2DicsdzCkkxlRvOy5o91EjmX82vr:L7zxAmb62Dimkwvho90282z
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1