Overview

overview

10

Static

static

10

0x00080000...29.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a2562441ad54f60b05ee1a3d3b4b780.exe_pw_infected.zip

  • Size

    558KB

  • Sample

    240720-qtbkfszerq

  • MD5

    f8af6dcc63249ca25ec20339037f63a8

  • SHA1

    0e355044e3f8879e13a1bb9fd10c0df150ee0e76

  • SHA256

    881bac57f08bf408d9816f103ed731ef9c77e51193f9268fec7dd2921ac2ad68

  • SHA512

    3ac6acfdf283209e7e1db60c5726762a66936eeb1e11e7795400134daac0422db419539fe4ac82db6dde844e2b40f3a80f02af3618434310d7decac5e1a7f5de

  • SSDEEP

    12288:qcHV/QQnRE/iaEydNmW0c612SA8grTfFMOZtP+K0itEu9Z/l1UAzz:NJ9noi3yHmWj61jiL7PVmAzz

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      0x000800000001aa1b-29

    • Size

      1.2MB

    • MD5

      e4ea9a5aee8f1d7576d8237b52fe345c

    • SHA1

      abf5a63f22b6d953a3cf8304f52cd2ceb1701055

    • SHA256

      d2d89b20e8f6fed21b4d8747df80d8c43107853e9d820cb9d5aeb832a36d773b

    • SHA512

      761f1ca9ea9dd5c2c0930d3681467924a1d4ab9cd64d02ddbe2d8555a021e96f9f8b260c3a80ea96d18115999f2289686b4644ee240864a0d3000620facf90e8

    • SSDEEP

      24576:SDCXO+I0bJuHAxXYessipGbea7pxn7bT2rgQ:SDSvIOB3E65

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (201) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks