General

  • Target

    2025-03-17_6092cf1a12890ad7d493c84ff7b1cd53_destroyer_wannacry

  • Size

    21KB

  • Sample

    250317-atn8jsxny5

  • MD5

    6092cf1a12890ad7d493c84ff7b1cd53

  • SHA1

    a753acd081229154cd34b9df39773e2787898358

  • SHA256

    a322a1b62304cd77ea58d0ec530efd3e3b032aa59ec579047bd25f14b4533289

  • SHA512

    b1c0172112eb993d7d64a5a3aeaaa03bd4fb169fe3ac0c5c1db7887611b6d37ea22b3101986dc4e97942a17637c6e7f7e0efbea81c96d8741184cca829e91313

  • SSDEEP

    384:g3MLWHn3kIEfW2pIXsQvudtKXRKJBr91CzoeeF:In3kIv2pIN2fKXRuBr9iveF

Malware Config

Targets

    • Target

      2025-03-17_6092cf1a12890ad7d493c84ff7b1cd53_destroyer_wannacry

    • Size

      21KB

    • MD5

      6092cf1a12890ad7d493c84ff7b1cd53

    • SHA1

      a753acd081229154cd34b9df39773e2787898358

    • SHA256

      a322a1b62304cd77ea58d0ec530efd3e3b032aa59ec579047bd25f14b4533289

    • SHA512

      b1c0172112eb993d7d64a5a3aeaaa03bd4fb169fe3ac0c5c1db7887611b6d37ea22b3101986dc4e97942a17637c6e7f7e0efbea81c96d8741184cca829e91313

    • SSDEEP

      384:g3MLWHn3kIEfW2pIXsQvudtKXRKJBr91CzoeeF:In3kIv2pIN2fKXRuBr9iveF

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Chaos family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks