General

  • Target

    231203-3sy1ksgb29_pw_infected.zip

  • Size

    99KB

  • Sample

    240412-c1jyhsfh3s

  • MD5

    3d774a34d14c8027c652d7a9302f8569

  • SHA1

    4d48e60fb7f52510e224b9cdc9dcf2d2ec4cec6f

  • SHA256

    c784e99fa44626f560b443a69d6e863ed93da635cd6bbd2785192e4ef298f7a3

  • SHA512

    cf968ad0b0ffbbe51e11298858a63ef9b1505c7b2a9a1463523851402649f5e0f81aa09ea13f7621ff0f9bfd30e79caf6bd3a1eced2bba594654341428bae56d

  • SSDEEP

    3072:yyvUvTaOC9CVZe2NO/cfnD60bWgz/Ei8n4x2PH:yoUvTlC9OZHNvb6QzErbH

Malware Config

Targets

    • Target

      Yashma ransomware builder v1.2.exe

    • Size

      538KB

    • MD5

      13e878ed7e547523cffc5728f6ba4190

    • SHA1

      878ad3025f8ea6b61ad4521782035963b3675a52

    • SHA256

      f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db

    • SHA512

      a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7

    • SSDEEP

      3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (196) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks