chaos

General

Target

SystemBlocker.zip
Size

215KB
Sample

221124-ychansed58
MD5

7da4e010d4d61005804de323e2a11ec7
SHA1

8892f1f0a32560982cf5093afc3904c4bf2598c7
SHA256

a03c529337d92e04f07fd09612cdf5fb335b1d96bf711f8d57a1d06ded2b6505
SHA512

5fd88a6086bf0835852093dc18c45347ae7b3b40f1273673e8c099d9ea49f58c07f305a60593ef20af79f072a1e547f69e2e7dc6590a7d8377dee33573f1e979
SSDEEP

3072:4IaU/hkBiFyhBSC/K2VAQlrw9CAWHYtpRPJzw9rVtpT+hlz2GCWAREDC9vryP:9/6BiFk7/KPQe9CAWE/P5wVIhlzcRmF

Score

10^/10

Malware Config

Targets

- Target
  
  Convert_mp4_to_mkv.exe
- Size
  
  290KB
- MD5
  
  62878b796562c411dd59d57dc2076967
- SHA1
  
  8f49669864e863ba3a081fe3bd10d88bfc01a10f
- SHA256
  
  f3c1bfeb62067c797eb43f47daec11e72c0cbc85d5c26ca001caba5f2732d20a
- SHA512
  
  49dd25c2c071376ccdf18ca2bc9d6c03a12226d1bd5e7cc04184d87b9e68c75cd4b4b3bd4d135ede3c821a65609ee26d97adecad9b89ccc5dfdc185d6c5b3795
- SSDEEP
  
  3072:H4dzVTaer344JzthRZijQ1Jf12bj8E7bwcZflRVGLDyHzZLB3VDELbkWSecuwjZf:HmRHz4mnREj21g3J/bwGLjejjH6erO
Score

10^/10

chaos microsoft evasion persistence phishing ransomware spyware stealer upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1