General
-
Target
2025-03-14_7257c0bf69e8818298bcbfb473e30b7e_chaos_destroyer_wannacry
-
Size
23KB
-
Sample
250314-szrvqstwcw
-
MD5
7257c0bf69e8818298bcbfb473e30b7e
-
SHA1
0e757c9a390830226e50550312e870b14a4ca08a
-
SHA256
7900c9346516bce522466c58c41e7db7e1f281b7acfcbcc87faec59ff4bd0e23
-
SHA512
c22291ff80a0c528527c37ea382d5cfa46987abb0223e82a5b62e159de1c6bd647fd801c9cf8eef0fb09f79c88f962b59281ef72784231fd757efd60d50235be
-
SSDEEP
384:d3Mg/bqo2mcxtivpZqjuwzUDJar91CKAxb5geJ:nqo2ptMpgjKFar9YxbaeJ
Behavioral task
behavioral1
Sample
2025-03-14_7257c0bf69e8818298bcbfb473e30b7e_chaos_destroyer_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-14_7257c0bf69e8818298bcbfb473e30b7e_chaos_destroyer_wannacry.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
chaos
Targets
-
-
Target
2025-03-14_7257c0bf69e8818298bcbfb473e30b7e_chaos_destroyer_wannacry
-
Size
23KB
-
MD5
7257c0bf69e8818298bcbfb473e30b7e
-
SHA1
0e757c9a390830226e50550312e870b14a4ca08a
-
SHA256
7900c9346516bce522466c58c41e7db7e1f281b7acfcbcc87faec59ff4bd0e23
-
SHA512
c22291ff80a0c528527c37ea382d5cfa46987abb0223e82a5b62e159de1c6bd647fd801c9cf8eef0fb09f79c88f962b59281ef72784231fd757efd60d50235be
-
SSDEEP
384:d3Mg/bqo2mcxtivpZqjuwzUDJar91CKAxb5geJ:nqo2ptMpgjKFar9YxbaeJ
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-