Overview

overview

10

Static

static

10

2024-10-16...ry.exe

windows7-x64

10

2024-10-16...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2024-10-16_7c556a045999ea1ca4f00d5b9b886b4c_destroyer_wannacry
  • Size 23KB
  • Sample241016-ppcraatapm
  • SHA256 8cafe2829a80bcc87175685e04d9297c8403453d274a2be2c90d764f0c88991d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Documents\read_it.txt

Ransom Note
  • All of your files have been stolen and encrypted. in a nutshell you're Hacked You can try whatever you wanna try but don't modify the files, they'll be damaged and impossible to decrypt. it's nothing personal, it's all about money. have a great day. Payment information Non payment will result in your data being published. YOU HAVE 7 DAYS, AFTER 3 DAYS THE MONEY DOUBLES. Bitcoin Address: bc1qpn32q8a3jykzpfnrv6crqulk7wguaryhxzadqa You must contact us using Tox messenger, download it here> https://tox.chat/download.html. Invite us on Tox, Our Tox ID : EEC1A34EA55C1DBC63D8BCC4779D93BB64FC9036C82210467DEB1948A3ABC2248CE1CAB7A181 You need contact us and decrypt one file for free on TOX messenger with your personal DECRYPTION ID 10212
URLs

  • https://tox.chat/download.html

Targets

    • Target
      2024-10-16_7c556a045999ea1ca4f00d5b9b886b4c_destroyer_wannacry
    • Size 23KB
    • SHA256 8cafe2829a80bcc87175685e04d9297c8403453d274a2be2c90d764f0c88991d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks