chaos

General

Target

2024-05-19_9d36b1ea9bb453d9e8a36a9c47093d8f_wannacry
Size

190KB
Sample

240519-fr2czsbf8w
MD5

9d36b1ea9bb453d9e8a36a9c47093d8f
SHA1

fc498d5362a09ee10587846a6827b9eee4b97071
SHA256

71af78b549961d7f2b3b493e79675ffad24c46b52e5b890eb6ab10654a57188a
SHA512

16e18d0e6d8683cba59c06f6dc083812ac95935bde9b300347f137445eac884c3c9a8d21a39d2d6fa023a8ab2238d4f7e84f95f7946d4c683f60880fe1f7baa6
SSDEEP

3072:VojMpkr9CYTDfGfse9dZ1Y7YHluSveP3JNs+zaQ15BMA7PUBmhgMcIeUw+1w+plq:Wxr9CY+fhhm7gcdP3z/BtPU0xZ1H

Score

10^/10

Malware Config

Targets

- Target
  
  2024-05-19_9d36b1ea9bb453d9e8a36a9c47093d8f_wannacry
- Size
  
  190KB
- MD5
  
  9d36b1ea9bb453d9e8a36a9c47093d8f
- SHA1
  
  fc498d5362a09ee10587846a6827b9eee4b97071
- SHA256
  
  71af78b549961d7f2b3b493e79675ffad24c46b52e5b890eb6ab10654a57188a
- SHA512
  
  16e18d0e6d8683cba59c06f6dc083812ac95935bde9b300347f137445eac884c3c9a8d21a39d2d6fa023a8ab2238d4f7e84f95f7946d4c683f60880fe1f7baa6
- SSDEEP
  
  3072:VojMpkr9CYTDfGfse9dZ1Y7YHluSveP3JNs+zaQ15BMA7PUBmhgMcIeUw+1w+plq:Wxr9CY+fhhm7gcdP3z/BtPU0xZ1H
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (200) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2