chaos

General

Target

2024-04-18_1d6025022bfdb40942e18ef789f64f96_wannacry
Size

233KB
Sample

240418-e4519scd2z
MD5

1d6025022bfdb40942e18ef789f64f96
SHA1

28ce22e4a5c86354557f47f7c2793ca9d47df88d
SHA256

59fe6fa8ae7590f93842e8a97e10d29571671fe8346444b3483d05622d261782
SHA512

b89556247ea57cc2d3e1bce534772e641fa9bcc4be983b4f2365dc20bd4d64401562b74d066de72143b6961fa98c8d463493859dc0fefdccb003bfdf3a6a2f36
SSDEEP

3072:C3c9wrWZt+em3xr8E1Q8dm0NYuaacYee2bE6//hXngpw4MmFQGvDre:C3c9hVr0Cu+Fp8Hvn

Score

10^/10

Malware Config

Targets

- Target
  
  2024-04-18_1d6025022bfdb40942e18ef789f64f96_wannacry
- Size
  
  233KB
- MD5
  
  1d6025022bfdb40942e18ef789f64f96
- SHA1
  
  28ce22e4a5c86354557f47f7c2793ca9d47df88d
- SHA256
  
  59fe6fa8ae7590f93842e8a97e10d29571671fe8346444b3483d05622d261782
- SHA512
  
  b89556247ea57cc2d3e1bce534772e641fa9bcc4be983b4f2365dc20bd4d64401562b74d066de72143b6961fa98c8d463493859dc0fefdccb003bfdf3a6a2f36
- SSDEEP
  
  3072:C3c9wrWZt+em3xr8E1Q8dm0NYuaacYee2bE6//hXngpw4MmFQGvDre:C3c9hVr0Cu+Fp8Hvn
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (159) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2