Extracted

• • Target

    2024-07-11_70b000a4afb6cd659c70068ae9a8da4e_wannacry

  • Size

    5.0MB

  • MD5

    70b000a4afb6cd659c70068ae9a8da4e

  • SHA1

    8e9f0c75ba7f08932aab4aac86ee33340314d879

  • SHA256

    e788b672c860e6088ddb0b042675f3ce2999bef473479598108896ffbb916bea

  • SHA512

    f40aae321ecde244521177d7d6a5127592c3e64c6babc27952464344e8c4f4f5449be8984c2ddb69ab6955b4537c2c717a968317b317d528f5f0d3861de61854

  • SSDEEP

    24576:xGNDuv4+PU64AoPrWdbb5+HRBlwOdXlI1y2Y5LwUMlx3IXVjUlRnua/OZuNG12Ho:ayyaQHzN9eOR2Rnu2GBcH56F2u0

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (234) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2