Resubmissions

12/07/2023, 15:42

230712-s5sdfseh5x 10

26/06/2023, 06:57

230626-hq1feagg93 10

General

  • Target

    WAGNER.bin.zip

  • Size

    148KB

  • Sample

    230626-hq1feagg93

  • MD5

    e83e9ac8a23b5395689b7576cc699313

  • SHA1

    273622e58355b2eef7594272b23ff5b31f9bb2ad

  • SHA256

    9e0eb28adc394c342b23f4abf2cb94a50ac8a0dc8f4b4ea058a3daad7f2b0c2f

  • SHA512

    34f5b43b205b90109f43103460a22f3acaf7267c2590129e5c976fa3c553451fd78694ed33f966ca9bd447768ccd560fff0cb015977ccdab4a2451f91b6fe5bb

  • SSDEEP

    3072:gQ/znGEGj+P3/TFhQotvO5fYiMzhboylSsPsAwkSzqFhkHzPnEUvdKyS+P6qjrV:JDdpPvhhHvO5f25PSsRe0kHzP3d3PnN

Malware Config

Targets

    • Target

      WAGNER.bin

    • Size

      321KB

    • MD5

      d26b2c8fc07cb5c72bfc40779f09d491

    • SHA1

      8ee7fc0171b980aa93b687e334d1e29a8d634085

    • SHA256

      1238ab3dd3ed620536969ee438e99a33a418ba20f5e691962ed07904e075b2a4

    • SHA512

      82133826566b5ea4404e0b080c6095b5c9fefe0bed87bb392f21f22c3a130848b43cac30c56a99aec281f225611d15e84ebdd07fff77e1f2354c838ea8396bad

    • SSDEEP

      6144:6r90F/rW+jyJ8ce0fASQFe4HNq4nJI2YPkuUDItcv7FL0pv:d/rxjyJNe0fAfe4HN1nJITPzUDItq7F4

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (209) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks