General
-
Target
s1.zip
-
Size
10KB
-
Sample
240612-sagcpsshkl
-
MD5
f5372ef3a32e4395385538a311f36d99
-
SHA1
f1cccf2ca7946dd7bd08a905bdead91aa22b19cb
-
SHA256
98df9c5905c1f8174e6f40869711bd658dc8f9724f81f1ede67a2cfd7595f85c
-
SHA512
ff6ecdbe0d7ca2f609c7207cc4c3243252cca9e313bec59ff9f2c115c4d0d41442567e7cfc5a143a19c7e6039f46cdbfbdaa8fcd5e3ef94af460f40e83fe70b3
-
SSDEEP
192:eUIjpRQ71btxDwf5sLnnlyr6Cugo2AbWHqielbLlxpJSz+viocVO/fEm053:Rz7qcyr61OYYqNb3ijOnEHV
Behavioral task
behavioral1
Sample
chaos-lab3-MALWARE.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
chaos-lab3-MALWARE.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\read_it.txt
chaos
Targets
-
-
Target
chaos-lab3-MALWARE.exe
-
Size
21KB
-
MD5
6de41e01f15b13212c5f63bcdbc220c0
-
SHA1
d4ac37f869e034a76b66dcdb0fdb8a3aa5f9edcb
-
SHA256
9578898ead6b426f3385939c924f75440a408c88a646f2a49d25958da77355ef
-
SHA512
42a256699e8baedb80dc6a7675b88aa85df634b1f3b6e5344a1680a1f99bdbe1cc591aa2d04d6c5f5a77612dc50cf0474f337b8f5be7f6fdb58de3944c3b618b
-
SSDEEP
384:RYenjLLADQDzCzk6KT6V29nOVp91tbeIbRxDG6:gc16Q9nc9bbeIbRxD9
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-