General
-
Target
2025-03-17_f3412def470db187f3a9b95ede250e73_destroyer_wannacry
-
Size
27KB
-
Sample
250317-gg86hsssdy
-
MD5
f3412def470db187f3a9b95ede250e73
-
SHA1
65be90a1ad51bec8140cec84b49ea576f68696ee
-
SHA256
8036cb4832edad45d44412716e288f9e354c30e88ea79958f66c1cd3c6e3cad4
-
SHA512
640ae4dc939696cedeef764284fb1c86391c704d6ab65a6c48af1f4c0f63945ef38b41a3503d0075476aa1b4ba62bc71a73a4f91ece249a9b7432731997ce31f
-
SSDEEP
384:4tWZPzzxAm1v85nIruz10CSGGCS6PNsnlyAOy5o91YVoL+82voP:N7zxAmAIruz10CGLkNiho9z682M
Behavioral task
behavioral1
Sample
2025-03-17_f3412def470db187f3a9b95ede250e73_destroyer_wannacry.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-03-17_f3412def470db187f3a9b95ede250e73_destroyer_wannacry.exe
Resource
win10v2004-20250314-en
Malware Config
Targets
-
-
Target
2025-03-17_f3412def470db187f3a9b95ede250e73_destroyer_wannacry
-
Size
27KB
-
MD5
f3412def470db187f3a9b95ede250e73
-
SHA1
65be90a1ad51bec8140cec84b49ea576f68696ee
-
SHA256
8036cb4832edad45d44412716e288f9e354c30e88ea79958f66c1cd3c6e3cad4
-
SHA512
640ae4dc939696cedeef764284fb1c86391c704d6ab65a6c48af1f4c0f63945ef38b41a3503d0075476aa1b4ba62bc71a73a4f91ece249a9b7432731997ce31f
-
SSDEEP
384:4tWZPzzxAm1v85nIruz10CSGGCS6PNsnlyAOy5o91YVoL+82voP:N7zxAmAIruz10CGLkNiho9z682M
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1