General
-
Target
2025-06-05_b6859233785ca9bc907c9ca9d6026a58_elex_wannacry
-
Size
131KB
-
Sample
250605-lz5m9svxhy
-
MD5
b6859233785ca9bc907c9ca9d6026a58
-
SHA1
842bc9ad08172e790209a8541bb6e12b5d861e80
-
SHA256
81819b95d88bb9d1d283f5439f0faf0316c28a59b4dc92541562a32830e05401
-
SHA512
cb1876717b9286fceabde3549ea1399da2e744c31efb45cd22b7bde7e0c56513ee35c8d814e1aefb64f3db1f7cd6ecfedaf2f2e0c43e0c01c71d8bb2eab4a37b
-
SSDEEP
3072:yo9Uur9oYXxr1mdGvCjqitjfANQYJmxFQKJBj9fpiDMNhVDHJ0v:Rr9oyxBmdG1iJ/YJmMChfpiMDp0
Behavioral task
behavioral1
Sample
2025-06-05_b6859233785ca9bc907c9ca9d6026a58_elex_wannacry.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-06-05_b6859233785ca9bc907c9ca9d6026a58_elex_wannacry.exe
Resource
win11-20250502-en
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
Targets
-
-
Target
2025-06-05_b6859233785ca9bc907c9ca9d6026a58_elex_wannacry
-
Size
131KB
-
MD5
b6859233785ca9bc907c9ca9d6026a58
-
SHA1
842bc9ad08172e790209a8541bb6e12b5d861e80
-
SHA256
81819b95d88bb9d1d283f5439f0faf0316c28a59b4dc92541562a32830e05401
-
SHA512
cb1876717b9286fceabde3549ea1399da2e744c31efb45cd22b7bde7e0c56513ee35c8d814e1aefb64f3db1f7cd6ecfedaf2f2e0c43e0c01c71d8bb2eab4a37b
-
SSDEEP
3072:yo9Uur9oYXxr1mdGvCjqitjfANQYJmxFQKJBj9fpiDMNhVDHJ0v:Rr9oyxBmdG1iJ/YJmMChfpiMDp0
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1