Extracted

• • Target

    2024-05-15_8211488f6520148d312e6b498aa4ff9d_chaos_destroyer_wannacry

  • Size

    23KB

  • MD5

    8211488f6520148d312e6b498aa4ff9d

  • SHA1

    99c95c9e010d2e3d512f7c68ff482e1e80262c2b

  • SHA256

    95091becfe2ce086fb66894624637c844ea89fb0076aec5d131c4b5e4f95edfd

  • SHA512

    36060945aceaeef7a084c0f91518daafa7d18361bda51b53ca3ebc09f83b3dc32e626b9216acc755e7b23fa8f34beec3c75ac6436562a678b3b32e0e72d0e4cd

  • SSDEEP

    384:S83Mg/bqo2PO0be6UpeAN4+X0Z/NJYDr91CO1pb5oevY:1qo2fdUpeg4+kR7YDr9Zpbeeg

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects command variations typically used by ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (195) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral1behavioral2