chaos | be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e

General

Target

2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe
Size

244KB
MD5

751df604e41a7e473fd3817b4c16d5f6
SHA1

30d6eacf97d1a5e6ec191f75a8eb16d9da54f218
SHA256

be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e
SHA512

6c546d46e6b7c0adffee2bdcf2b85b786b57fbf73c4213e39bf54e4ceaceaa5f143e0e9d57d0398464074e46c0242bd649fa80615d1dc3db32f08b061a7629d7
SSDEEP

6144:8+jn7PfWDycKPudCuS74kvw6Mr9zmduLb+70pKXQl29ur4cm:8+gycSzre2q+70pKXQl29ur4c

Score

10^/10

chaos persistence ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/748-133-0x0000017EA3900000-0x0000017EA3944000-memory.dmp	family_chaos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
2824	PerfWaston2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	PerfWaston2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	PerfWaston2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2824	748	2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe	83
PID 748 wrote to memory of 2824	748	2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe	83
PID 748 wrote to memory of 2824	748	2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe	83

C:\Users\Admin\AppData\Local\Temp\2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2023-04-12_751df604e41a7e473fd3817b4c16d5f6_wannacry.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe
  "C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe

Filesize
135KB

MD5
7f0b75bd98b323f54ed6b283a49b69b5

SHA1
9b09f703a968c5001665657557ce402c60b95e54

SHA256
725ff72b2dccc79b7d2b3dc0ef346d992ec46bd022eeb628318a954cc4309241

SHA512
e2397905fa9ed4a94fa573ce1bb4b4da830b9e8461b8231a9e3d5042d41c032eb6760ea31d68bc9cb7f197d1acdf72b16e8f0338f3a504777f6a264c214ed961

Download Submit
C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe

Filesize
135KB

MD5
7f0b75bd98b323f54ed6b283a49b69b5

SHA1
9b09f703a968c5001665657557ce402c60b95e54

SHA256
725ff72b2dccc79b7d2b3dc0ef346d992ec46bd022eeb628318a954cc4309241

SHA512
e2397905fa9ed4a94fa573ce1bb4b4da830b9e8461b8231a9e3d5042d41c032eb6760ea31d68bc9cb7f197d1acdf72b16e8f0338f3a504777f6a264c214ed961

Download Submit
C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe

Filesize
135KB

MD5
7f0b75bd98b323f54ed6b283a49b69b5

SHA1
9b09f703a968c5001665657557ce402c60b95e54

SHA256
725ff72b2dccc79b7d2b3dc0ef346d992ec46bd022eeb628318a954cc4309241

SHA512
e2397905fa9ed4a94fa573ce1bb4b4da830b9e8461b8231a9e3d5042d41c032eb6760ea31d68bc9cb7f197d1acdf72b16e8f0338f3a504777f6a264c214ed961

Download Submit
memory/748-133-0x0000017EA3900000-0x0000017EA3944000-memory.dmp

Filesize
272KB

Download
memory/748-136-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/748-137-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/748-135-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/748-161-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/748-160-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/748-159-0x0000017EBDDA0000-0x0000017EBDDB0000-memory.dmp

Filesize
64KB

Download
memory/2824-151-0x0000000005540000-0x00000000055D2000-memory.dmp

Filesize
584KB

Download
memory/2824-152-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/2824-153-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/2824-154-0x0000000005510000-0x000000000551A000-memory.dmp

Filesize
40KB

Download
memory/2824-155-0x00000000057B0000-0x0000000005806000-memory.dmp

Filesize
344KB

Download
memory/2824-156-0x0000000007140000-0x000000000766C000-memory.dmp

Filesize
5.2MB

Download
memory/2824-158-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/2824-150-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download
memory/2824-149-0x00000000053E0000-0x000000000547C000-memory.dmp

Filesize
624KB

Download
memory/2824-148-0x0000000000A40000-0x0000000000A68000-memory.dmp

Filesize
160KB

Download
memory/2824-162-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/2824-163-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing