chaos

General

Target

2024-07-30_8798c00ba8b599989cc3a06da8c28a6e_wannacry
Size

388KB
Sample

240730-h9551azbpe
MD5

8798c00ba8b599989cc3a06da8c28a6e
SHA1

e79dbefc0b3747ec1767679e273c3f049143179a
SHA256

41bf69dda3999dc09e8cccf7475ecd7a000b64cdfc1c462672eb9dc7e42d21a9
SHA512

9bfaeb723104771001e9dbfbab81196a99ac2fe2f0fb9dc5cd5966941594b42ddfc91b1c182fda9c3f1c186187b7642edd149e0763b99def9d34a5104e4789b2
SSDEEP

12288:Ms48+MRhQbpN9++qzKdSxs23to2G4LyGA6Jyx:MszuCsi

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Updater6\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-07-30_8798c00ba8b599989cc3a06da8c28a6e_wannacry
- Size
  
  388KB
- MD5
  
  8798c00ba8b599989cc3a06da8c28a6e
- SHA1
  
  e79dbefc0b3747ec1767679e273c3f049143179a
- SHA256
  
  41bf69dda3999dc09e8cccf7475ecd7a000b64cdfc1c462672eb9dc7e42d21a9
- SHA512
  
  9bfaeb723104771001e9dbfbab81196a99ac2fe2f0fb9dc5cd5966941594b42ddfc91b1c182fda9c3f1c186187b7642edd149e0763b99def9d34a5104e4789b2
- SSDEEP
  
  12288:Ms48+MRhQbpN9++qzKdSxs23to2G4LyGA6Jyx:MszuCsi
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2