chaos

General

Target

kache.exe
Size

506KB
Sample

240601-rgzbesfa89
MD5

03b0db0d3c3ce0f7c19e88219b296922
SHA1

c950bd85b8d302307654fdc848329b4a58cf3949
SHA256

c127022b5b4f3b93311a1f13c660324da03e0dfa698c4c0a9656cd2863c28160
SHA512

d99c946e98c82c9cc4191959b3c016af1885fac9275156499f442b162613c538f0f9f4d3776ad1e040bfd33cbe1d216808356ec1528f1b19eb6c10ded4d47cb6
SSDEEP

12288:HX4GQOqb2ciwew/IFR9AILH0PhDieMlMK2j9mI4ygA2Vv95uekHKe:RsZJK2f6U

Score

10^/10

Malware Config

Targets

- Target
  
  kache.exe
- Size
  
  506KB
- MD5
  
  03b0db0d3c3ce0f7c19e88219b296922
- SHA1
  
  c950bd85b8d302307654fdc848329b4a58cf3949
- SHA256
  
  c127022b5b4f3b93311a1f13c660324da03e0dfa698c4c0a9656cd2863c28160
- SHA512
  
  d99c946e98c82c9cc4191959b3c016af1885fac9275156499f442b162613c538f0f9f4d3776ad1e040bfd33cbe1d216808356ec1528f1b19eb6c10ded4d47cb6
- SSDEEP
  
  12288:HX4GQOqb2ciwew/IFR9AILH0PhDieMlMK2j9mI4ygA2Vv95uekHKe:RsZJK2f6U
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (198) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2