chaos

General

Target

2024-08-22_54ac9ddc07c55d0eb31496d02f892d1d_wannacry
Size

153KB
Sample

240822-nkw4paxcmm
MD5

54ac9ddc07c55d0eb31496d02f892d1d
SHA1

843fcbed1d4112ce2c4caa885b8428ba6905f203
SHA256

feb75c383454ed660e8b4dc038dc1c76927bbfac281c6614a73de8042a93ddcb
SHA512

1d1949b2ce1cb7e1fba7776b67d7bba9395781f381b5a4a7aeb6d7827fee16480c6228bc3cf0eb2c18cd41bd4ff1a264c15cf7b6b278f3e6863a57cc58fb9a89
SSDEEP

3072:AL18c9hj72AompDgm7EFFrLfPdxFzW5zmUEEa2XslNT0:q8c9BZBp1EvtxFzASUEEa2Xs3T

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\awdawdaw.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Targets

- Target
  
  2024-08-22_54ac9ddc07c55d0eb31496d02f892d1d_wannacry
- Size
  
  153KB
- MD5
  
  54ac9ddc07c55d0eb31496d02f892d1d
- SHA1
  
  843fcbed1d4112ce2c4caa885b8428ba6905f203
- SHA256
  
  feb75c383454ed660e8b4dc038dc1c76927bbfac281c6614a73de8042a93ddcb
- SHA512
  
  1d1949b2ce1cb7e1fba7776b67d7bba9395781f381b5a4a7aeb6d7827fee16480c6228bc3cf0eb2c18cd41bd4ff1a264c15cf7b6b278f3e6863a57cc58fb9a89
- SSDEEP
  
  3072:AL18c9hj72AompDgm7EFFrLfPdxFzW5zmUEEa2XslNT0:q8c9BZBp1EvtxFzASUEEa2Xs3T
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2