Extracted

• • Target

    2025-02-17_c97fb12a2cf0c4fc6c0e38451987725f_chaos_destroyer_wannacry

  • Size

    26KB

  • MD5

    c97fb12a2cf0c4fc6c0e38451987725f

  • SHA1

    cf78f883f0661d221d2a0351888200ccf7985181

  • SHA256

    4a9d86eabf96dac50beb78e33e188427520c08670053f6599bf374f523906592

  • SHA512

    e7560496328a7a0638b7fceb34b4772ce47b4b314d2c3bedf4775ec961e12ee8f267a6f0429ad20afe51ead8f45329d5f78c7c9f2f604a7b4300c2fd966acf24

  • SSDEEP

    384:9YenjLLA70loMPQ9Ce2OVp91Rk+b5dxDGi:M70lPYSc93k+bTxDN

  Score

  10^/10

  chaosransomwarespywarestealeradwarediscoverypersistenceprivilege_escalation

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Chaos family

    chaos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2