chaos

General

Target

2025-02-22_0772d9df47836609fbfdd95ce144b683_wannacry
Size

117KB
Sample

250222-brt7fsxjs3
MD5

0772d9df47836609fbfdd95ce144b683
SHA1

2cfe3bebd9c1eda6f8478dd6f8271b42ddcba7c6
SHA256

25fba19a79ca6ef0c1f8b092c8f6e0cb4ac91239089b2764f73bf59c29a544ef
SHA512

86631a262c35324091fdbbffc5499b60b69d37b41496bd8b52fe85355c97ca07f6005e02eef4244622b4dd7659c9effa560e5ca3afb4f0f98ed2d3af6b062b86
SSDEEP

3072:1oyESEKr9zTg9RUa2WgSEBYBEHgX0oz15WXf:XNr9zToN2WfNX0ozvq

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-22_0772d9df47836609fbfdd95ce144b683_wannacry
- Size
  
  117KB
- MD5
  
  0772d9df47836609fbfdd95ce144b683
- SHA1
  
  2cfe3bebd9c1eda6f8478dd6f8271b42ddcba7c6
- SHA256
  
  25fba19a79ca6ef0c1f8b092c8f6e0cb4ac91239089b2764f73bf59c29a544ef
- SHA512
  
  86631a262c35324091fdbbffc5499b60b69d37b41496bd8b52fe85355c97ca07f6005e02eef4244622b4dd7659c9effa560e5ca3afb4f0f98ed2d3af6b062b86
- SSDEEP
  
  3072:1oyESEKr9zTg9RUa2WgSEBYBEHgX0oz15WXf:XNr9zToN2WfNX0ozvq
Score

10^/10

chaos hawkeye defense_evasion evasion execution impact keylogger ransomware spyware stealer trojan
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (216) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2