chaos

General

Target

2024-02-20_82e9d7ead2705f060c47d00f6095f968_wannacry
Size

210KB
Sample

240220-nrrsjsfe7x
MD5

82e9d7ead2705f060c47d00f6095f968
SHA1

7bfc8ac899c98c28918545a0b4b6063fa8ff06e8
SHA256

a2837287e1dd493f83ad6a175ecb41fe7c3bbae96f1976e704ad5503ec4319a8
SHA512

5983a54772b44b1ed661ad165334583f8330f217d23bfcf5b505d8a79a7fc955da856a21af63560f44f6ac53d59e7e7cc8a109b3c2bc6e1a83a27ae8ade18c4c
SSDEEP

3072:OJ4BKv1Et9jDWHoC97M26+MZjQQbKGUE3T9Mg5hw0GlVdopP:LK6t9jDWHH7+jUGULsWVq

Score

10^/10

Malware Config

Targets

- Target
  
  2024-02-20_82e9d7ead2705f060c47d00f6095f968_wannacry
- Size
  
  210KB
- MD5
  
  82e9d7ead2705f060c47d00f6095f968
- SHA1
  
  7bfc8ac899c98c28918545a0b4b6063fa8ff06e8
- SHA256
  
  a2837287e1dd493f83ad6a175ecb41fe7c3bbae96f1976e704ad5503ec4319a8
- SHA512
  
  5983a54772b44b1ed661ad165334583f8330f217d23bfcf5b505d8a79a7fc955da856a21af63560f44f6ac53d59e7e7cc8a109b3c2bc6e1a83a27ae8ade18c4c
- SSDEEP
  
  3072:OJ4BKv1Et9jDWHoC97M26+MZjQQbKGUE3T9Mg5hw0GlVdopP:LK6t9jDWHH7+jUGULsWVq
Score

10^/10

chaos evasion persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Detects executables packed with ConfuserEx Mod
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2