General
-
Target
07a4369a072400badfe18af90d5783969d65726c4529d6aff3fd586dbfb3dfe6.exe
-
Size
26KB
-
Sample
240128-x2dhcahhfl
-
MD5
077d154d4908b364054602f7796419a0
-
SHA1
884d6006ced20f83606d37a7fe8ee9e6ec3b323b
-
SHA256
5ea2b78bede7c796c3b2c7ce5865022f61a78396a0039b4f4bc8b75586710713
-
SHA512
281dc2ea520e0383d03895d36489b2eeb85c7b987cb4e7452097948e4afd0825e0f9ff8abd745c4ec707c5aa22f16ce0404b1caee02a3337820586c22098892c
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qeb5hxDGC:5OElB6sc9GebXxDN
Behavioral task
behavioral1
Sample
07a4369a072400badfe18af90d5783969d65726c4529d6aff3fd586dbfb3dfe6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
07a4369a072400badfe18af90d5783969d65726c4529d6aff3fd586dbfb3dfe6.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Targets
-
-
Target
07a4369a072400badfe18af90d5783969d65726c4529d6aff3fd586dbfb3dfe6.exe
-
Size
26KB
-
MD5
077d154d4908b364054602f7796419a0
-
SHA1
884d6006ced20f83606d37a7fe8ee9e6ec3b323b
-
SHA256
5ea2b78bede7c796c3b2c7ce5865022f61a78396a0039b4f4bc8b75586710713
-
SHA512
281dc2ea520e0383d03895d36489b2eeb85c7b987cb4e7452097948e4afd0825e0f9ff8abd745c4ec707c5aa22f16ce0404b1caee02a3337820586c22098892c
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qeb5hxDGC:5OElB6sc9GebXxDN
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Renames multiple (168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-