Extracted

• • Target

    2024-05-28_f43183982e1e945e6b4016ef17878334_destroyer_wannacry

  • Size

    89KB

  • MD5

    f43183982e1e945e6b4016ef17878334

  • SHA1

    4601ee37490cefd2fd1d4ecd3fb7ef1624b80300

  • SHA256

    5af421300e6483ba025d74e6d6d3c62d4baa99675bda232ca2817820962574ae

  • SHA512

    0a13c0fdb0dea8b453c4d4f77926bf2e7d3bb01040fbc95a7897054f9b0bdc738234ee76c99a3d76eeb37fc5d3b6d4fdb50c3dfbde972ebd9f877a535b058130

  • SSDEEP

    1536:/qW9Tl+nb7VvhbwTdfs1NNkP1tU097CZYKBCVonLLpXM:SW9Tl+BhMTxSNNOU0h2FCVmfp8

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects command variations typically used by ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (237) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2