Overview

overview

10

Static

static

10

main.exe

windows7-x64

10

main.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.exe

  • Size

    537KB

  • Sample

    240719-w6tvfstgqn

  • MD5

    db63c855e1a1f5ee8bbeb93a5c6a94d3

  • SHA1

    bb88714fddab5ebf931141b831954d99b91d2394

  • SHA256

    c423bd973d16de69ee63ff5321c3e2cbc5dd4fcf6c30a9e4e2fdb752449a26b9

  • SHA512

    0045bcd3d07da072aae92f508a806b529e6eb2d62d9c09eef85208a3083a4d9748a9d74346561f151d0b4e6e8bfba78ff8f80ae35fc717709ff3a25ce71b3172

  • SSDEEP

    12288:Pq4W8F32U2rKrMtiDUsZL6g+e8gk255H63:PzmVK4MULLy5B

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      main.exe

    • Size

      537KB

    • MD5

      db63c855e1a1f5ee8bbeb93a5c6a94d3

    • SHA1

      bb88714fddab5ebf931141b831954d99b91d2394

    • SHA256

      c423bd973d16de69ee63ff5321c3e2cbc5dd4fcf6c30a9e4e2fdb752449a26b9

    • SHA512

      0045bcd3d07da072aae92f508a806b529e6eb2d62d9c09eef85208a3083a4d9748a9d74346561f151d0b4e6e8bfba78ff8f80ae35fc717709ff3a25ce71b3172

    • SSDEEP

      12288:Pq4W8F32U2rKrMtiDUsZL6g+e8gk255H63:PzmVK4MULLy5B

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks