General
-
Target
WAGNER.bin.zip
-
Size
148KB
-
Sample
230626-hq1feagg93
-
MD5
e83e9ac8a23b5395689b7576cc699313
-
SHA1
273622e58355b2eef7594272b23ff5b31f9bb2ad
-
SHA256
9e0eb28adc394c342b23f4abf2cb94a50ac8a0dc8f4b4ea058a3daad7f2b0c2f
-
SHA512
34f5b43b205b90109f43103460a22f3acaf7267c2590129e5c976fa3c553451fd78694ed33f966ca9bd447768ccd560fff0cb015977ccdab4a2451f91b6fe5bb
-
SSDEEP
3072:gQ/znGEGj+P3/TFhQotvO5fYiMzhboylSsPsAwkSzqFhkHzPnEUvdKyS+P6qjrV:JDdpPvhhHvO5f25PSsRe0kHzP3d3PnN
Behavioral task
behavioral1
Sample
WAGNER.exe
Resource
win10v2004-20230621-en
Malware Config
Targets
-
-
Target
WAGNER.bin
-
Size
321KB
-
MD5
d26b2c8fc07cb5c72bfc40779f09d491
-
SHA1
8ee7fc0171b980aa93b687e334d1e29a8d634085
-
SHA256
1238ab3dd3ed620536969ee438e99a33a418ba20f5e691962ed07904e075b2a4
-
SHA512
82133826566b5ea4404e0b080c6095b5c9fefe0bed87bb392f21f22c3a130848b43cac30c56a99aec281f225611d15e84ebdd07fff77e1f2354c838ea8396bad
-
SSDEEP
6144:6r90F/rW+jyJ8ce0fASQFe4HNq4nJI2YPkuUDItcv7FL0pv:d/rxjyJNe0fAfe4HN1nJITPzUDItq7F4
Score10/10-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Renames multiple (209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-