General
-
Target
AZ(DANGEROUS).exe
-
Size
549KB
-
Sample
220117-tcfdvsbab7
-
MD5
b3858953d8c79049f6a46b254e6eab6b
-
SHA1
e4407979997b5e1000abaac3a75545e82e8a15b9
-
SHA256
6a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
-
SHA512
6c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
Static task
static1
Behavioral task
behavioral1
Sample
AZ(DANGEROUS).exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
AZ(DANGEROUS).exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Admin\Desktop\README.txt
https://computernewb.com/wiki/CollabVM
http://gg.gg/NOU2022
Extracted
C:\Users\Admin\Downloads\TraceOpen.txt
ryuk
Targets
-
-
Target
AZ(DANGEROUS).exe
-
Size
549KB
-
MD5
b3858953d8c79049f6a46b254e6eab6b
-
SHA1
e4407979997b5e1000abaac3a75545e82e8a15b9
-
SHA256
6a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
-
SHA512
6c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-