General
-
Target
Comprovante de depósito.exe
-
Size
378KB
-
Sample
220214-trdtksbefp
-
MD5
668a6e809dd0554cde27c3a28ea01c43
-
SHA1
aa02e2999168ee64f6d3ccc3218a131881fa7c37
-
SHA256
d9771a04128e50870a96bc7ac8605982205011b723810a04a3411a1ac7eba05d
-
SHA512
616ebfdc7018833d6f876394b601de98c5f1132189f28558a41993d02de8119ebdd2c3c2ccc1d6ca28085c18466dfa574ae40f3072d3c25b4be14f3144c98efb
Static task
static1
Behavioral task
behavioral1
Sample
Comprovante de depósito.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
Extracted
C:\Users\Admin\Downloads\FormatRemove.txt
ryuk
Extracted
C:\Users\Admin\Desktop\BackupRestart.html
ryuk
Targets
-
-
Target
Comprovante de depósito.exe
-
Size
378KB
-
MD5
668a6e809dd0554cde27c3a28ea01c43
-
SHA1
aa02e2999168ee64f6d3ccc3218a131881fa7c37
-
SHA256
d9771a04128e50870a96bc7ac8605982205011b723810a04a3411a1ac7eba05d
-
SHA512
616ebfdc7018833d6f876394b601de98c5f1132189f28558a41993d02de8119ebdd2c3c2ccc1d6ca28085c18466dfa574ae40f3072d3c25b4be14f3144c98efb
-
Chaos Ransomware
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-