General
-
Target
a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.zip
-
Size
12KB
-
Sample
220429-nmebnaaca9
-
MD5
4f08c42da886634553f891d0bb538777
-
SHA1
88232eb712057850afd4873fc04aaf12ae1ff09b
-
SHA256
23bbfd73fa0ccd200881fcfa1d02b5c2aff96ff821cf3a804c94044d326bd2a6
-
SHA512
0201e4bba9d46df35bd644b871ba0493cba47bc746591478df7f9cb2387437344260ce3c44566fa296afc041c8cd9da929f730f1e6652fc45e5cef60317f983c
Static task
static1
Behavioral task
behavioral1
Sample
a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\Desktop\readme.txt
http://ibpwmfrlbwkfd4asg57t4x2vkrczuq3uhrfxf6y35xoalwjlztil54ad.onion
Extracted
C:\Users\Admin\Downloads\HideClose.mht
ryuk
Extracted
C:\Users\Admin\AppData\Roaming\CompleteRead.mht
ryuk
Targets
-
-
Target
a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.exe
-
Size
26KB
-
MD5
cf6ff9e0403b8d89e42ae54701026c1f
-
SHA1
a4f5cb11b9340f80a89022131fb525b888aa8bc6
-
SHA256
a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b
-
SHA512
dca369de908ff4d8a6b095243d8837ad9eb885c78544565586196451f99303e9beb8635e01254514b485f22298b3eaf69afb3666b6032959ae3e9567e78dc575
Score10/10-
Chaos Ransomware
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Drops desktop.ini file(s)
-