General

  • Target

    ad048cb7ab0f1948352444de9d073595c5e00cb9019769224aa4468c1513694c

  • Size

    321KB

  • Sample

    230814-sm9vsaeg5t

  • MD5

    1c5d7e1c7f66479aba9892373ca47936

  • SHA1

    1a248b5f6b5a6de4fa0beed0577085a0d6fc29a3

  • SHA256

    ad048cb7ab0f1948352444de9d073595c5e00cb9019769224aa4468c1513694c

  • SHA512

    46dbf69a94c27e90c1b05af68c36e7a46dacccec9dc5ac774ab44ab26c6255634ac2204d6e8824568fb8665efde03470995626060da67a82ac86a46988ef2d69

  • SSDEEP

    6144:3c96T6oPWwru29S+Ycj5jVFdZzElrd5o2rxMnmUfA:FTlPWwru29SRe5jVfZzWrrdxMmUf

Malware Config

Targets

    • Target

      ad048cb7ab0f1948352444de9d073595c5e00cb9019769224aa4468c1513694c

    • Size

      321KB

    • MD5

      1c5d7e1c7f66479aba9892373ca47936

    • SHA1

      1a248b5f6b5a6de4fa0beed0577085a0d6fc29a3

    • SHA256

      ad048cb7ab0f1948352444de9d073595c5e00cb9019769224aa4468c1513694c

    • SHA512

      46dbf69a94c27e90c1b05af68c36e7a46dacccec9dc5ac774ab44ab26c6255634ac2204d6e8824568fb8665efde03470995626060da67a82ac86a46988ef2d69

    • SSDEEP

      6144:3c96T6oPWwru29S+Ycj5jVFdZzElrd5o2rxMnmUfA:FTlPWwru29SRe5jVfZzWrrdxMmUf

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks