General
-
Target
231203-3sy1ksgb29_pw_infected.zip
-
Size
99KB
-
Sample
240412-c1jyhsfh3s
-
MD5
3d774a34d14c8027c652d7a9302f8569
-
SHA1
4d48e60fb7f52510e224b9cdc9dcf2d2ec4cec6f
-
SHA256
c784e99fa44626f560b443a69d6e863ed93da635cd6bbd2785192e4ef298f7a3
-
SHA512
cf968ad0b0ffbbe51e11298858a63ef9b1505c7b2a9a1463523851402649f5e0f81aa09ea13f7621ff0f9bfd30e79caf6bd3a1eced2bba594654341428bae56d
-
SSDEEP
3072:yyvUvTaOC9CVZe2NO/cfnD60bWgz/Ei8n4x2PH:yoUvTlC9OZHNvb6QzErbH
Behavioral task
behavioral1
Sample
Yashma ransomware builder v1.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Yashma ransomware builder v1.2.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
Yashma ransomware builder v1.2.exe
-
Size
538KB
-
MD5
13e878ed7e547523cffc5728f6ba4190
-
SHA1
878ad3025f8ea6b61ad4521782035963b3675a52
-
SHA256
f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
-
SHA512
a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
-
SSDEEP
3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz
Score10/10-
Chaos Ransomware
-
Modifies boot configuration data using bcdedit
-
Renames multiple (196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-