chaos

General

Target

2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry
Size

31KB
Sample

240516-hr14bshd82
MD5

7ac66cd243c6782f8e11680398bf7fc9
SHA1

8a64f2ae6b6529f761a606eca390f28e958564ff
SHA256

1d697c827da729fceea49235066a4a711f473d9b9ad04971977db97aa0b7bd34
SHA512

ddc59db33aa6d9b5fdbc78cb24de64ec0d9a4de9681dc55ac702cdf917f27888c17cf7a7e837e74eacadaf6b4e35df80661849026868bf7e8744b29ffaddc25c
SSDEEP

384:ytWZPzzxAm1vIJ5ZQomFVdeOeTbzyvQC/JpcllOy5o91fgnpu82vm:X7zxAmWDuXdreKQuJWho9CA82u

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-05-16_7ac66cd243c6782f8e11680398bf7fc9_destroyer_wannacry
- Size
  
  31KB
- MD5
  
  7ac66cd243c6782f8e11680398bf7fc9
- SHA1
  
  8a64f2ae6b6529f761a606eca390f28e958564ff
- SHA256
  
  1d697c827da729fceea49235066a4a711f473d9b9ad04971977db97aa0b7bd34
- SHA512
  
  ddc59db33aa6d9b5fdbc78cb24de64ec0d9a4de9681dc55ac702cdf917f27888c17cf7a7e837e74eacadaf6b4e35df80661849026868bf7e8744b29ffaddc25c
- SSDEEP
  
  384:ytWZPzzxAm1vIJ5ZQomFVdeOeTbzyvQC/JpcllOy5o91fgnpu82vm:X7zxAmWDuXdreKQuJWho9CA82u
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2