Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ransomware.exe
-
Size
15KB
-
Sample
240628-fbb36a1grh
-
MD5
ac6b23f341c93a5deb6692d8fed6f6a4
-
SHA1
6466c45b8c8dd60f03392614063d1c490231bf03
-
SHA256
cb84c85fb50de9ac3bc4763c504ca87067680bc129d44c256570f7e1449ab9c5
-
SHA512
d4483be2b241c12da57785d861018e88d75fbda736e51900872d105f11309474393c8381d654c4cf74242a7f138e070983ace9836806232afda9dee30e3dd29f
-
SSDEEP
192:1XiJtJHunl2T7IeLX/LnG8dcIbNbqiv8Fums5oglkr5i7amD2Ayqfiq1T5Fx/TAU:1Cul2nIePG2vVCZ87ThT1n
Behavioral task
behavioral1
Sample
ransomware.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Users\Admin\Pictures\read_it.txt
https://bitpay.com/
https://www.exodus.com/
https://www.blockchain.com/wallet
Targets
-
-
Target
ransomware.exe
-
Size
15KB
-
MD5
ac6b23f341c93a5deb6692d8fed6f6a4
-
SHA1
6466c45b8c8dd60f03392614063d1c490231bf03
-
SHA256
cb84c85fb50de9ac3bc4763c504ca87067680bc129d44c256570f7e1449ab9c5
-
SHA512
d4483be2b241c12da57785d861018e88d75fbda736e51900872d105f11309474393c8381d654c4cf74242a7f138e070983ace9836806232afda9dee30e3dd29f
-
SSDEEP
192:1XiJtJHunl2T7IeLX/LnG8dcIbNbqiv8Fums5oglkr5i7amD2Ayqfiq1T5Fx/TAU:1Cul2nIePG2vVCZ87ThT1n
Score10/10-
Chaos Ransomware
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-