Overview

overview

10

Static

static

10

976cfac92a...e6.exe

windows7-x64

10

976cfac92a...e6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6

  • Size

    181KB

  • Sample

    240229-kpsehsca85

  • MD5

    a321ec0a5cb29407a0fa4d8e39586dee

  • SHA1

    5a7fb5ee8a0cc0482fe6dce7a80696bd92ef0ca9

  • SHA256

    976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6

  • SHA512

    21e0f35818d7015a9b639929064fa89d83f712c472f23dcf0863742e9daf24120812c3adca4d8c46fc9d1201b20c80a9810e847b92722da8665ba33a4247517e

  • SSDEEP

    3072:3NSvwL1IDAdAN+Uj7xRQIb+GinxNNB/hwlPaMhg/pxeJjYekLfncU1AlLncSRq5W:dSvwL6DAdAN+Uj7xRQIb2xY3hgxxedbF

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6

    • Size

      181KB

    • MD5

      a321ec0a5cb29407a0fa4d8e39586dee

    • SHA1

      5a7fb5ee8a0cc0482fe6dce7a80696bd92ef0ca9

    • SHA256

      976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6

    • SHA512

      21e0f35818d7015a9b639929064fa89d83f712c472f23dcf0863742e9daf24120812c3adca4d8c46fc9d1201b20c80a9810e847b92722da8665ba33a4247517e

    • SSDEEP

      3072:3NSvwL1IDAdAN+Uj7xRQIb+GinxNNB/hwlPaMhg/pxeJjYekLfncU1AlLncSRq5W:dSvwL6DAdAN+Uj7xRQIb2xY3hgxxedbF

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Renames multiple (240) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks