Extracted

• • Target

    Microsoft Edge.exe

  • Size

    202KB

  • MD5

    0d2f471b69b41bbb1ec5ae51c95e2275

  • SHA1

    e69d4d5267d3785850c10f288aa34d72cf4ab8d5

  • SHA256

    d954f795ec9e5dcdf8bdaa4abfb52840554e5409cafb8ab5bc9f8361f7a4ff68

  • SHA512

    a8733badd6e9cb64a8dcc4b6860bc8ba37060a465f2d818b7d1db04c8a6d7e97904a47d19620b50e0ba461a6bb3d631ec9be78656bccaee946a444935a9d5f76

  • SSDEEP

    3072:Ho7kJr9UiTCmp6VF+hj5ifQloDIs8x0qyW5Uu7/e5BV0RUniyL4R:jr9UiT0P+hVljLvjvDe5v0RUYR

  Score

  10^/10

  chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (168) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2