Extracted

• • Target

    2024-08-22_fffcec172fd2e908588f098ce331f3e7_chaos_destroyer_wannacry

  • Size

    22KB

  • MD5

    fffcec172fd2e908588f098ce331f3e7

  • SHA1

    9846f2ca442cf1080ce104d737f90052fc5592a6

  • SHA256

    91ef0318ac9a10ce0976b29f57ea570b6907cccc92f182f5e916d5273f0b71e3

  • SHA512

    381b0691bb4e8c1bf0e7a4038c320faa112ad4b7d38ae2aa61c362aee7d6eedbb9c351ec5c57577af7081fc1d2c4e4ab756a282f63ba860f70ad3f06f27d9a3d

  • SSDEEP

    384:u3Mg/bqo2I8wvTbLpXFugOjnJyjr91CbIde4:Mqo2javpkgOjJMr90ge4

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral1behavioral2