chaos | 6d4fdb81ba3d3005f83e87f1b28fd48fbfe213a6dd164b95d939b9391faff82e | Triage

Resubmissions

04/03/2025, 15:32

250304-syy8estrw6 10

31/01/2025, 12:59

250131-p8d4fswmbx 10

27/01/2025, 15:12

250127-slapastrfy 10

24/01/2025, 15:20

250124-sqxpmawncj 10

22/01/2025, 17:56

250122-wjahasypaj 10

21/01/2025, 17:40

250121-v8zcaawjcj 10

21/01/2025, 15:38

250121-s26fxa1ndk 10

21/01/2025, 14:09

250121-rglekaxlcw 10

Sharing

General

Target

2025-01-21_07244d8bbd0721454ea97e696b6e85d3_wannacry
Size

352KB
Sample

250124-sqxpmawncj
MD5

07244d8bbd0721454ea97e696b6e85d3
SHA1

06bc9b13360ac74b019cab18c96cc888474afc52
SHA256

6d4fdb81ba3d3005f83e87f1b28fd48fbfe213a6dd164b95d939b9391faff82e
SHA512

73c5fa9ee0bf8f91daa41f15932b0138329990d192bda0b75b90bd2f70fc8aaab28f509c9562355942a0563c418c96f99c0322e149e8c9b6d8ff83f14e3a8061
SSDEEP

6144:gV3r9iXlkEt9RGv5IKp/ntL2FJGAJRaWJ1rQPNDEDKx22LV:gglkEHshIKpvtg4AJRaWkp

Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Targets

- Target
  
  2025-01-21_07244d8bbd0721454ea97e696b6e85d3_wannacry
- Size
  
  352KB
- MD5
  
  07244d8bbd0721454ea97e696b6e85d3
- SHA1
  
  06bc9b13360ac74b019cab18c96cc888474afc52
- SHA256
  
  6d4fdb81ba3d3005f83e87f1b28fd48fbfe213a6dd164b95d939b9391faff82e
- SHA512
  
  73c5fa9ee0bf8f91daa41f15932b0138329990d192bda0b75b90bd2f70fc8aaab28f509c9562355942a0563c418c96f99c0322e149e8c9b6d8ff83f14e3a8061
- SSDEEP
  
  6144:gV3r9iXlkEt9RGv5IKp/ntL2FJGAJRaWJ1rQPNDEDKx22LV:gglkEHshIKpvtg4AJRaWkp
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer