General
-
Target
Chaos Ransomware Builder v4.exe
-
Size
550KB
-
Sample
211010-kdbbvsfgck
-
MD5
8b855e56e41a6e10d28522a20c1e0341
-
SHA1
17ea75272cfe3749c6727388fd444d2c970f9d01
-
SHA256
f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
-
SHA512
eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
Static task
static1
Behavioral task
behavioral1
Sample
Chaos Ransomware Builder v4.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Chaos Ransomware Builder v4.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0
Extracted
C:\Users\Admin\Downloads\DisconnectPop.txt
ryuk
Targets
-
-
Target
Chaos Ransomware Builder v4.exe
-
Size
550KB
-
MD5
8b855e56e41a6e10d28522a20c1e0341
-
SHA1
17ea75272cfe3749c6727388fd444d2c970f9d01
-
SHA256
f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
-
SHA512
eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-