chaos

General

Target

9c7713c8cd8233686ea25551b426fef708636c7fc2eea2978a9333772aa3b527.exe
Size

2.3MB
Sample

240730-xccjrasgpn
MD5

0610189e95dbee895c8f710b7abf0bb2
SHA1

433adc0d669b364bcca0d7594eb6f58d80a467bb
SHA256

9c7713c8cd8233686ea25551b426fef708636c7fc2eea2978a9333772aa3b527
SHA512

85c6b68bf39cc3389e1aad5745b318f55b3ee8505060e459bb3d0a2f6d0468f1f3d3335f7a2618627b080eb342681709fa7cfe327c76c1422b2f7360575d1e73
SSDEEP

24576:3aA/tcwqNwOMPhkx3W0CiO2wlqXGMvZ115EGDxsnbMQ:lOwqS0/3qSGEpRUb

Score

10^/10

Malware Config

Targets

- Target
  
  9c7713c8cd8233686ea25551b426fef708636c7fc2eea2978a9333772aa3b527.exe
- Size
  
  2.3MB
- MD5
  
  0610189e95dbee895c8f710b7abf0bb2
- SHA1
  
  433adc0d669b364bcca0d7594eb6f58d80a467bb
- SHA256
  
  9c7713c8cd8233686ea25551b426fef708636c7fc2eea2978a9333772aa3b527
- SHA512
  
  85c6b68bf39cc3389e1aad5745b318f55b3ee8505060e459bb3d0a2f6d0468f1f3d3335f7a2618627b080eb342681709fa7cfe327c76c1422b2f7360575d1e73
- SSDEEP
  
  24576:3aA/tcwqNwOMPhkx3W0CiO2wlqXGMvZ115EGDxsnbMQ:lOwqS0/3qSGEpRUb
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (181) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2