Extracted

• • Target

    2024-08-24_a90af5ea0a8e921cdc865a4fed968d1d_wannacry

  • Size

    130KB

  • MD5

    a90af5ea0a8e921cdc865a4fed968d1d

  • SHA1

    40a06b8bcf636a0bdc013a80b4374b0f0086c937

  • SHA256

    762c08cdf989acfdcabe495979d7384ac5fbb1988f6f77b4a21be7bbda2b7a8b

  • SHA512

    35dc75a2e855d6bcfc5a010e2fd1c5a64ffbbae7de94d192e1e889c2ef6762eb39746370be7b8b22a8c05e115f000fdd52aba054f4b71fffbe37fa3fea25d5ba

  • SSDEEP

    3072:8QN0Y5q+1VYk2vURGHFUeR4ZBFr9KRrVJIbLkKiQjI4KuXS:8QNVLeHF54Z7r9iTIbdidJu

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2