chaos

General

Target

NEAS.2023-09-07_09217f184957662f513865f4af084528_wannacry_JC.exe
Size

265KB
Sample

231022-m9k72shf32
MD5

09217f184957662f513865f4af084528
SHA1

293538860eacbba54a7f9d85c8ef450db014e176
SHA256

199ab1c7c1b2f7ccfafd692756f45dfe307b4acfcbac4d00641d14b7e4a03923
SHA512

96264cfb7089e76655e118e671184a231f5e7ed4ec133dd8f36479d100878540701f083e93e369a87e1234406ec684dde2bf86860038a6e579b89520bf6d2dff
SSDEEP

6144:KOq9KZw2tJ0B+x5IMnK8V3diKtKtdU6icE:KoZw6JC+x5IMnK2diGKf5i

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\How_to_Recovery_files.bat

Ransom Note

echo off color 0a cls :MENU ECHO. ECHO -----!!! ALL YOUR FILES ARE ENCRYPTED !!!-------- ECHO. ECHO. Don't worry, you can return all your files! ECHO. ECHO All your files, documents, photos, databases and other important files are encrypted. ECHO. ECHO. The only method of recovering files is to purchase an unique private key with our decrypt Tools. ECHO. Only we can give you this key and only we can recover your files. ECHO. To be sure that we have a decryptor and it works, you can decrypt one file for free. ECHO. But this file should be of not valuable! ECHO. Attention do not try to decrypt the files using other Tools, ECHO. they may break and we will not be able to decrypt it. ECHO. ECHO. You must follow these steps To decrypt your files : ECHO. 1) In message please write your ID and wait your answer. ECHO. 2) Write on our [email protected] ( In case of no answer in 24 hours check your spam folder ECHO. or write us to Telegram ID https://t.me/cp00pc1) ECHO. Your ID is (QA2Z67DXLBFF11200FHN) ECHO. ECHO. 3) Obtain Bitcoin (You have to pay for decryption in Bitcoins. ECHO. After payment we will send you the tool that will decrypt all your files.) ECHO. ECHO. ECHO. ECHO.By SirAttacker SET /P M=

Emails

[email protected]

URLs

https://t.me/cp00pc1

Targets

- Target
  
  NEAS.2023-09-07_09217f184957662f513865f4af084528_wannacry_JC.exe
- Size
  
  265KB
- MD5
  
  09217f184957662f513865f4af084528
- SHA1
  
  293538860eacbba54a7f9d85c8ef450db014e176
- SHA256
  
  199ab1c7c1b2f7ccfafd692756f45dfe307b4acfcbac4d00641d14b7e4a03923
- SHA512
  
  96264cfb7089e76655e118e671184a231f5e7ed4ec133dd8f36479d100878540701f083e93e369a87e1234406ec684dde2bf86860038a6e579b89520bf6d2dff
- SSDEEP
  
  6144:KOq9KZw2tJ0B+x5IMnK8V3diKtKtdU6icE:KoZw6JC+x5IMnK2diGKf5i
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2