chaos

General

Target

2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry
Size

238KB
Sample

240803-ewn3sashrn
MD5

86faf18098e56c8c610b960d684a21d8
SHA1

db0eb3968c11da86490b679e7daded59b6006310
SHA256

4e758d011d1d615ebd05c6ffe441dedf5d371efb1dca1c624ec896f56de19979
SHA512

8c87c1847edeb56fc46d0e1adcf3bb8cc024d63fa9d2d49dd7bda68efb1c5fe473f001250408accccb86915cc5f077a46a28189b073cdd557d9042e48c7f4a9b
SSDEEP

3072:K6Mq98ySh8of8yx/se2nz2j0XdNkgVjdLyWNgXc0IohbnivKUbUtHO9sO3LccckL:K6Mq9e2q+nRfkg7Scy4KUQHO9h3LN

Score

10^/10

Malware Config

Targets

- Target
  
  2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry
- Size
  
  238KB
- MD5
  
  86faf18098e56c8c610b960d684a21d8
- SHA1
  
  db0eb3968c11da86490b679e7daded59b6006310
- SHA256
  
  4e758d011d1d615ebd05c6ffe441dedf5d371efb1dca1c624ec896f56de19979
- SHA512
  
  8c87c1847edeb56fc46d0e1adcf3bb8cc024d63fa9d2d49dd7bda68efb1c5fe473f001250408accccb86915cc5f077a46a28189b073cdd557d9042e48c7f4a9b
- SSDEEP
  
  3072:K6Mq98ySh8of8yx/se2nz2j0XdNkgVjdLyWNgXc0IohbnivKUbUtHO9sO3LccckL:K6Mq9e2q+nRfkg7Scy4KUQHO9h3LN
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (194) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2