Overview

overview

10

Static

static

10

ebc90f7e16...41.exe

windows7-x64

10

ebc90f7e16...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55ff901e986a52d6e0700210a74a1ece69fdb3e0c5497f641ec6483a3c0f8751.zip

  • Size

    329KB

  • Sample

    221005-ql79fsede6

  • MD5

    2f0c08446e6f6dd75aceaf67ebad2f77

  • SHA1

    a58dd9be0907debb8f39cb357e458a93612ac79c

  • SHA256

    55ff901e986a52d6e0700210a74a1ece69fdb3e0c5497f641ec6483a3c0f8751

  • SHA512

    76b12e89c69105ca97075b2490870248813ae732bdbeb1c161b46bd4ba13d3a74b8e7d7f901b031a909cd8a6c42af03f703a99c63b5136648b2e7fe97470a8c7

  • SSDEEP

    6144:gcVbL0hiIOM8+LDCvzCnQHw67feMv8KiPuTL94H:gcVJIOd+vCvnJ8tPuF4H

Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe

    • Size

      329KB

    • MD5

      eb9c6acdedd1e8a8bfd266403bfd520a

    • SHA1

      c835f8e3fe7f35b7c61cffe842056bd573ce939b

    • SHA256

      ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41

    • SHA512

      ff67f19d8d986917bbd4d6d00d0fae4b9907960108d4e00202d8e579d95e82b0c9386a07050c406157ba3f0a4d31d3f6aa89f09955ec5551607764679688fc32

    • SSDEEP

      6144:+cVbL0hiIOM8+LDCvzCnQHw67feMv8KiPuTL94:+cVJIOd+vCvnJ8tPuF4

    Score
    10/10
    chaosevasionpersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

3
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4
T1490

Tasks