General
-
Target
230726-rv6mnadf4v
-
Size
953KB
-
Sample
240312-mayn4aee4v
-
MD5
adb3dde4a25e596c16ced4cdfc6ff8dd
-
SHA1
7934e6bc9489933c0af8dfe7bdff482fc6759bdc
-
SHA256
8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44
-
SHA512
f14c27892ed4d11bdd46a130abc7fa40ae8c4577bcd45c3af7c5928b82f27c3646b906fda880e5c9df623071edaab8de82fd46af8f3194f33d7d46c2c3d1d587
-
SSDEEP
12288:vEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzzjc:/ztQE1ov2AZ9HjkftWy3P
Behavioral task
behavioral1
Sample
230726-rv6mnadf4v.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
230726-rv6mnadf4v.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Documents\PLEASEREAD.txt
Targets
-
-
Target
230726-rv6mnadf4v
-
Size
953KB
-
MD5
adb3dde4a25e596c16ced4cdfc6ff8dd
-
SHA1
7934e6bc9489933c0af8dfe7bdff482fc6759bdc
-
SHA256
8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44
-
SHA512
f14c27892ed4d11bdd46a130abc7fa40ae8c4577bcd45c3af7c5928b82f27c3646b906fda880e5c9df623071edaab8de82fd46af8f3194f33d7d46c2c3d1d587
-
SSDEEP
12288:vEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzzjc:/ztQE1ov2AZ9HjkftWy3P
Score10/10-
Chaos Ransomware
-
Detects command variations typically used by ransomware
-
Modifies boot configuration data using bcdedit
-
Renames multiple (212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-