Extracted

Extracted

• • Target

    B4ZDS.ps1

  • Size

    493B

  • MD5

    100782038a6f5875ad82a97aba1f0a78

  • SHA1

    12729f2ffc46a08105ceb10e0e65f2e96602b677

  • SHA256

    b77228530068b5deecd20933e07583c378bfe89d683ed6688841bad9b95999c2

  • SHA512

    bfdf367b8c34d21f42e21f0b84da02d449713399781eb26a6e5917416eef7b67e58fd9168d0ad73429f21cd781c8d945648bf77c9c5fb789a1754e86d5a143de

  Score

  10^/10

  chaosevasionpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2