Extracted

• • Target

    2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry

  • Size

    877KB

  • MD5

    9d8e89b9385730b406a3a1aca542568d

  • SHA1

    e681e7b38ddfcfecc5574b893b30ba5744c04bb9

  • SHA256

    2bbff41fc9130ce1d19babdbe120a44a4d3c40d08b6ffd0edc65a3a71da41ebf

  • SHA512

    4a947d095d2c463292e9e8f67497e3d73fb63721a3e1aef83f93f617381b7b4dc951e9dc27b0a46e5b724446dd8d18ab0e69cb92849e644154ce4ee4c2bbd790

  • SSDEEP

    12288:VNsvP/BulDVh+OqcAJCDSnuvVjt7wce7KpTOpdBdNd9Rkv9i2cNJoWg+h6/j/dxX:haNu/iJNolNQ+00

  Score

  10^/10

  chaosneshtaevasionpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2