General
-
Target
dead.7z
-
Size
1.3MB
-
Sample
220508-jlyaxseeer
-
MD5
e34a27319d3b8e1db6278e254838eb0d
-
SHA1
e131e651ed84b2bd0f339efdb5db4a95ba772ceb
-
SHA256
16aba772af1763cce32eae03538f38efb716a8ed36e81ca6a2b4da2db8dbdbae
-
SHA512
9a394bb62affd28b2077300b493bff9e41f4c4f220b5a9d6ddff5492cb54ac27f65dc327aa71c00a5788e5549c3763c548ef8065b03f02433e394a5089666f60
Behavioral task
behavioral1
Sample
dead.exe
Resource
win7-20220414-en
Malware Config
Extracted
C:\Users\Admin\Desktop\readme.txt
https://www.astolfo.lgbt/
https://absolllute.com/store/view_mega_hack_pro
https://x.synapse.to/
https://script-ware.com/
https://protosmasher.net/
Extracted
C:\Users\Admin\AppData\Roaming\InstallRename.html
ryuk
Targets
-
-
Target
dead.exe
-
Size
2.2MB
-
MD5
b3b5313f4d4d239f5d22a84ef29eb892
-
SHA1
ac0dd7326305bfee3d19b31ee56c9cbc9b3253f5
-
SHA256
7df566bbfebbfb07e45989d68668365c56d17d55b013bb30c58de0485d337067
-
SHA512
c68ead18d282247be06d05c235dc7c07ab9871358b42e9f5756aa2e43bc694dd34a5288b65d1d4d9a0092ca162f3c9aa8d7ca5f6b47ed46973a31b6334a8ba57
-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-