General
-
Target
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
Size
610KB
-
Sample
210906-hhm54safa3
-
MD5
deb8f4311fd52319f6168c10b626c808
-
SHA1
f4807d71a1048d05815a09b74997f338e26ba9ff
-
SHA256
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
SHA512
ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685
Static task
static1
Behavioral task
behavioral1
Sample
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\Desktop\README.txt
Targets
-
-
Target
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
Size
610KB
-
MD5
deb8f4311fd52319f6168c10b626c808
-
SHA1
f4807d71a1048d05815a09b74997f338e26ba9ff
-
SHA256
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
SHA512
ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685
Score10/10-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-