General
-
Target
104db93a4dbe06c0b58d2ac8156e353fe46d7e096ef3e57ec63a6b231932ad7d.exe
-
Size
26KB
-
Sample
240128-117xcacfcr
-
MD5
3c79df1fb66404c9fec64fbb34764ad1
-
SHA1
3cd9ca5bb3c51d94047207fa5b5e4da662d7ade6
-
SHA256
3c5e1cfc8b03e3acb2287d3fea8ca950d8175b22e7313d41705911ac79b4a222
-
SHA512
1731493f7d028af2dc8cd3cc8d9eb6456e643d346be9ad7fafac535755403e4457d569623407ecf8e9c51dae7e26bd7f25cc103ecbe1387152cc9ba86738de69
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QVb5hxDG/:5OElB6sc9GVbXxDE
Behavioral task
behavioral1
Sample
104db93a4dbe06c0b58d2ac8156e353fe46d7e096ef3e57ec63a6b231932ad7d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
104db93a4dbe06c0b58d2ac8156e353fe46d7e096ef3e57ec63a6b231932ad7d.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Targets
-
-
Target
104db93a4dbe06c0b58d2ac8156e353fe46d7e096ef3e57ec63a6b231932ad7d.exe
-
Size
26KB
-
MD5
3c79df1fb66404c9fec64fbb34764ad1
-
SHA1
3cd9ca5bb3c51d94047207fa5b5e4da662d7ade6
-
SHA256
3c5e1cfc8b03e3acb2287d3fea8ca950d8175b22e7313d41705911ac79b4a222
-
SHA512
1731493f7d028af2dc8cd3cc8d9eb6456e643d346be9ad7fafac535755403e4457d569623407ecf8e9c51dae7e26bd7f25cc103ecbe1387152cc9ba86738de69
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91QVb5hxDG/:5OElB6sc9GVbXxDE
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Renames multiple (162) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-