Overview

overview

10

Static

static

3

trabajo escuela.exe

windows7-x64

10

trabajo escuela.exe

windows10-1703-x64

10

trabajo escuela.exe

windows10-2004-x64

10

trabajo escuela.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 21:00

240409-ztcbesed8x 10

13-10-2021 12:07

211013-paebkaeah7 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    trabajo escuela.exe

  • Size

    614KB

  • Sample

    240409-ztcbesed8x

  • MD5

    535994874b99eea69b30569bc7176440

  • SHA1

    e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5

  • SHA256

    79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7

  • SHA512

    12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f

  • SSDEEP

    12288:YctEagGmcl4gBF1BRnI6hAVebOe1qOX+t4Z3Fy0RMDbXScaTRM:ZR+cl7X1BRnI6hmebOe1qMuJXifu

Score
10/10
chaosevasionransomwarespywarestealer

Malware Config

Targets

    • Target

      trabajo escuela.exe

    • Size

      614KB

    • MD5

      535994874b99eea69b30569bc7176440

    • SHA1

      e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5

    • SHA256

      79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7

    • SHA512

      12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f

    • SSDEEP

      12288:YctEagGmcl4gBF1BRnI6hAVebOe1qOX+t4Z3Fy0RMDbXScaTRM:ZR+cl7X1BRnI6hmebOe1qMuJXifu

    Score
    10/10
    chaosevasionransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks