General
-
Target
20240910f4546cd292db332bd3450843677a210achaosdestroyerwannacry
-
Size
32KB
-
Sample
240910-r8h4hszhjh
-
MD5
f4546cd292db332bd3450843677a210a
-
SHA1
e933a17670e7ccf12bd74940f1b28e484be890a3
-
SHA256
a34420684f2cac84d72ed9ce886e22327e8d316cb13b177076b6eac639149499
-
SHA512
217703a0b55c7e2923bb5b659c489141ec8d96ae97eaa423d9881eb4fdbd31b5913c5ee3813e513f60ec0da37c826295517acca293edab153cff11df47a2c604
-
SSDEEP
384:sYenjLLA+rjoA71WcA0OZz89Zdi+tYSx4EOVp91iNgoF2lfpV1FxDGp:rwcAZmo9Ztc9wSoF2dxDW
Behavioral task
behavioral1
Sample
20240910f4546cd292db332bd3450843677a210achaosdestroyerwannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20240910f4546cd292db332bd3450843677a210achaosdestroyerwannacry.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read.txt
decodefilesonline@gmail.com
Targets
-
-
Target
20240910f4546cd292db332bd3450843677a210achaosdestroyerwannacry
-
Size
32KB
-
MD5
f4546cd292db332bd3450843677a210a
-
SHA1
e933a17670e7ccf12bd74940f1b28e484be890a3
-
SHA256
a34420684f2cac84d72ed9ce886e22327e8d316cb13b177076b6eac639149499
-
SHA512
217703a0b55c7e2923bb5b659c489141ec8d96ae97eaa423d9881eb4fdbd31b5913c5ee3813e513f60ec0da37c826295517acca293edab153cff11df47a2c604
-
SSDEEP
384:sYenjLLA+rjoA71WcA0OZz89Zdi+tYSx4EOVp91iNgoF2lfpV1FxDGp:rwcAZmo9Ztc9wSoF2dxDW
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-