General
-
Target
2024-11-07_bcf9a3f92706b2cb338459dd52488472_wannacry
-
Size
352KB
-
Sample
241107-llql7azfqm
-
MD5
bcf9a3f92706b2cb338459dd52488472
-
SHA1
5e31b8509abc813d474577c6785e961ced7cc697
-
SHA256
1229e2bf183c624411a3ee4efb10a27a500593b36c9f2643d1c2222479cea83d
-
SHA512
53b4c972c21a18551af1a2803855d73acf344e566b5bf85a88b985c00a4cd5e00cf1bfe0dcafe25fcfe2c0616dc0473a45cfd9918cedea0d4c87a988ed5bdb23
-
SSDEEP
6144:lQsq9wlNPowTMHRSsfcUN1x/Vy21WW/R3mj8YR9em2fG9p:lQMl6wTMHR51WsR2j8YRwm2fyp
Behavioral task
behavioral1
Sample
2024-11-07_bcf9a3f92706b2cb338459dd52488472_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-07_bcf9a3f92706b2cb338459dd52488472_wannacry.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2024-11-07_bcf9a3f92706b2cb338459dd52488472_wannacry
-
Size
352KB
-
MD5
bcf9a3f92706b2cb338459dd52488472
-
SHA1
5e31b8509abc813d474577c6785e961ced7cc697
-
SHA256
1229e2bf183c624411a3ee4efb10a27a500593b36c9f2643d1c2222479cea83d
-
SHA512
53b4c972c21a18551af1a2803855d73acf344e566b5bf85a88b985c00a4cd5e00cf1bfe0dcafe25fcfe2c0616dc0473a45cfd9918cedea0d4c87a988ed5bdb23
-
SSDEEP
6144:lQsq9wlNPowTMHRSsfcUN1x/Vy21WW/R3mj8YR9em2fG9p:lQMl6wTMHR51WsR2j8YRwm2fyp
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1