chaos

General

Target

2024-04-15_a995c4d5b506266750e5314bb4ba2eee_wannacry
Size

233KB
Sample

240415-zn3w7aab9z
MD5

a995c4d5b506266750e5314bb4ba2eee
SHA1

732076bcc2a12224c76c8f336e73a23a510a8d52
SHA256

0388b2592814fee8b53d26abe2a920269abdb064641214e8081fc2ae3d2781de
SHA512

9cb9b03be9ae84db1aad26508802be9ffff77358fc4051fec197f19b5487668db6970a0559ea8cf9d9812677d88f22c5033e4adc60c43999fa95f9396265e5b5
SSDEEP

3072:ic9RrWZt+em3xr8E1Q8dm0NYuaacYee2bE6//hXngpw4MmFQGvDrv:ic96Vr0Cu+Fp8Hvn

Score

10^/10

Malware Config

Targets

- Target
  
  2024-04-15_a995c4d5b506266750e5314bb4ba2eee_wannacry
- Size
  
  233KB
- MD5
  
  a995c4d5b506266750e5314bb4ba2eee
- SHA1
  
  732076bcc2a12224c76c8f336e73a23a510a8d52
- SHA256
  
  0388b2592814fee8b53d26abe2a920269abdb064641214e8081fc2ae3d2781de
- SHA512
  
  9cb9b03be9ae84db1aad26508802be9ffff77358fc4051fec197f19b5487668db6970a0559ea8cf9d9812677d88f22c5033e4adc60c43999fa95f9396265e5b5
- SSDEEP
  
  3072:ic9RrWZt+em3xr8E1Q8dm0NYuaacYee2bE6//hXngpw4MmFQGvDrv:ic96Vr0Cu+Fp8Hvn
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (173) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2