General
-
Target
2025-03-18_7605fb5c749eeea0b1b27fdaad78051c_wannacry
-
Size
137KB
-
Sample
250318-b4m9nsstaw
-
MD5
7605fb5c749eeea0b1b27fdaad78051c
-
SHA1
28388bf016af085bbcbacf8c516853942f6ec8d3
-
SHA256
466a92e378a95752870abddd6af278fba89c5fef2cb3adfe2c4c114b9bd7cd93
-
SHA512
1a3780652e092bd0be5c45cf034b2d0737324009c4d7d74e5cca193f75f285be85fa1631a68c6955566206dc3d51ba2dab9c4acfc74f9652ed2c04976ae3ee54
-
SSDEEP
3072:pc98R9CAHAcKf55kNONO4vIfUye3tYsfNL1sLp:pc9cxhipvjt3yiW
Behavioral task
behavioral1
Sample
2025-03-18_7605fb5c749eeea0b1b27fdaad78051c_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-18_7605fb5c749eeea0b1b27fdaad78051c_wannacry.exe
Resource
win10v2004-20250313-en
Malware Config
Targets
-
-
Target
2025-03-18_7605fb5c749eeea0b1b27fdaad78051c_wannacry
-
Size
137KB
-
MD5
7605fb5c749eeea0b1b27fdaad78051c
-
SHA1
28388bf016af085bbcbacf8c516853942f6ec8d3
-
SHA256
466a92e378a95752870abddd6af278fba89c5fef2cb3adfe2c4c114b9bd7cd93
-
SHA512
1a3780652e092bd0be5c45cf034b2d0737324009c4d7d74e5cca193f75f285be85fa1631a68c6955566206dc3d51ba2dab9c4acfc74f9652ed2c04976ae3ee54
-
SSDEEP
3072:pc98R9CAHAcKf55kNONO4vIfUye3tYsfNL1sLp:pc9cxhipvjt3yiW
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1