General
-
Target
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
Size
610KB
-
Sample
240723-q8alpswflc
-
MD5
deb8f4311fd52319f6168c10b626c808
-
SHA1
f4807d71a1048d05815a09b74997f338e26ba9ff
-
SHA256
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
SHA512
ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685
-
SSDEEP
6144:vOr9ptAkuoip7RLPIZ3s3FjC4nj5ImCEb:AAkuoK7RLPIoAZEb
Behavioral task
behavioral1
Sample
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053.exe
Resource
win11-20240709-en
Malware Config
Extracted
C:\Users\Admin\Documents\README.txt
Targets
-
-
Target
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
Size
610KB
-
MD5
deb8f4311fd52319f6168c10b626c808
-
SHA1
f4807d71a1048d05815a09b74997f338e26ba9ff
-
SHA256
1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053
-
SHA512
ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685
-
SSDEEP
6144:vOr9ptAkuoip7RLPIZ3s3FjC4nj5ImCEb:AAkuoK7RLPIoAZEb
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-