Extracted

• • Target

    2024-08-22_8e98d1884214273f81880124de326c18_wannacry

  • Size

    162KB

  • MD5

    8e98d1884214273f81880124de326c18

  • SHA1

    60a38aa52cfa23b03486b246b26e65ce6dc0bf6d

  • SHA256

    cf14edacaa7fa7b13431d72cec2198a737b7ff7064c0de76f26792bc57230b2b

  • SHA512

    2291dce2fe09cf780be926afacc4b96da880a620ddcb13c88e424fe57260ec98b218feb6c875b7413ae5391f4617f1f99e46bf569ae46acbb747ee388f616174

  • SSDEEP

    3072:OLjQc9oj72AompDgm7EFFrLfPdxFzW5zmUEEa2XslNTs3:OQc94ZBp1EvtxFzASUEEa2Xs3T

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2