chaos | 4e44d16e3c4274d3a49d8562299659b7177632e484ca7ba3c0d7a95bc44d686a | Triage

Sharing

General

Target

2025-02-16_6a5d6de74af2307b9ddb8e7e0a05aec3_wannacry
Size

130KB
Sample

250216-3p4rnasrdt
MD5

6a5d6de74af2307b9ddb8e7e0a05aec3
SHA1

a9bb545b11c8b4415359fead7a92ea848f508530
SHA256

4e44d16e3c4274d3a49d8562299659b7177632e484ca7ba3c0d7a95bc44d686a
SHA512

bffc0eed72576ac2b0d68410db02d76369bd937d9a4767cc0edd021343cf8f0a81af9813cb0038726ff61ac274f81ae4144f3717148807ba5973b7103408f8f2
SSDEEP

768:w7zxAmCgnegjDho9Ws82FOfMCwRhOF15utoS:wNCRADq9W3cS/wCFLS

Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

[email protected]

Targets

- Target
  
  2025-02-16_6a5d6de74af2307b9ddb8e7e0a05aec3_wannacry
- Size
  
  130KB
- MD5
  
  6a5d6de74af2307b9ddb8e7e0a05aec3
- SHA1
  
  a9bb545b11c8b4415359fead7a92ea848f508530
- SHA256
  
  4e44d16e3c4274d3a49d8562299659b7177632e484ca7ba3c0d7a95bc44d686a
- SHA512
  
  bffc0eed72576ac2b0d68410db02d76369bd937d9a4767cc0edd021343cf8f0a81af9813cb0038726ff61ac274f81ae4144f3717148807ba5973b7103408f8f2
- SSDEEP
  
  768:w7zxAmCgnegjDho9Ws82FOfMCwRhOF15utoS:wNCRADq9W3cS/wCFLS
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer discovery
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

behavioral2

chaosdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer