chaos | c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc | Triage

Submit
Reports

Overview

overview

Static

static

c3f0bfffe8...in.exe

windows7-x64

c3f0bfffe8...in.exe

windows10-2004-x64

Sharing

General

Target

c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc.bin.sample
Size

147KB
Sample

240625-na98kawekf
MD5

b12ba245044aebefd213e83d96bbe30e
SHA1

13dd3338a25156109ba6957d05d5639d8e12d275
SHA256

c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc
SHA512

e7865415f12621d4a327ba2d7741a6f9354a758c2d7727d081e4b2787e9d01b971f8c4693dd7540f982a15de668f9596e25f13900d7d6fb5de04be199ec4d682
SSDEEP

3072:5o8RI41lgr9x+panT9OmELeyWGccgdkguuZ/0t9Fk20Jh2cLkZDqlkya2:DI4gr9x+SxOxWndwuZ/0nFDKLR8

Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc.bin.exe

Resource

win7-20240508-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc.bin.exe

Resource

win10v2004-20240508-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc.bin.sample
- Size
  
  147KB
- MD5
  
  b12ba245044aebefd213e83d96bbe30e
- SHA1
  
  13dd3338a25156109ba6957d05d5639d8e12d275
- SHA256
  
  c3f0bfffe865e3b8de9cb96dada72c743bec39626010d9ebe926c9d326b56fdc
- SHA512
  
  e7865415f12621d4a327ba2d7741a6f9354a758c2d7727d081e4b2787e9d01b971f8c4693dd7540f982a15de668f9596e25f13900d7d6fb5de04be199ec4d682
- SSDEEP
  
  3072:5o8RI41lgr9x+panT9OmELeyWGccgdkguuZ/0t9Fk20Jh2cLkZDqlkya2:DI4gr9x+SxOxWndwuZ/0nFDKLR8
Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

behavioral2

chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

© 2018-2025

Terms | Privacy