chaos

General

Target

2024-04-18_796433c0bafdc31ebce886e73e0b81b4_destroyer_wannacry
Size

72KB
Sample

240418-fg4qcsch4s
MD5

796433c0bafdc31ebce886e73e0b81b4
SHA1

1b7fbbfbb41a48eaa2a0cb617d4649fae78639de
SHA256

4379db96453cddab9c7975cec29837bb3b40063fa1973ecce3b1f3551521eed1
SHA512

83081baf466d0afe07853e57e0372eae89645020404f47955ceb29db39527caa3b64885b0f379c72ec19bfc316680a498a6544ede371fb114793fc931c2643b9
SSDEEP

768:SlPlZnVZwc9BBxcxDnAFDHJUdoP0hd3M2VArJdPOCk:y9f+c9B1jBcCk

Score

10^/10

Malware Config

Targets

- Target
  
  2024-04-18_796433c0bafdc31ebce886e73e0b81b4_destroyer_wannacry
- Size
  
  72KB
- MD5
  
  796433c0bafdc31ebce886e73e0b81b4
- SHA1
  
  1b7fbbfbb41a48eaa2a0cb617d4649fae78639de
- SHA256
  
  4379db96453cddab9c7975cec29837bb3b40063fa1973ecce3b1f3551521eed1
- SHA512
  
  83081baf466d0afe07853e57e0372eae89645020404f47955ceb29db39527caa3b64885b0f379c72ec19bfc316680a498a6544ede371fb114793fc931c2643b9
- SSDEEP
  
  768:SlPlZnVZwc9BBxcxDnAFDHJUdoP0hd3M2VArJdPOCk:y9f+c9B1jBcCk
Score

10^/10

chaos evasion ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2