chaos

General

Target

main_exe_18342021827.zip
Size

497KB
Sample

240731-1nhfxszcqe
MD5

66d962439490417246f71f2beb0d6295
SHA1

2ad786f01494af3792133cf60c4f1f07a688c819
SHA256

60984522c325cba997ddcdd6442ddde7425ed039d9ba96bfdc44ec644983edcf
SHA512

e29844ac1c0df3ad21202de31d3e533f0193475cb20428026bd1d529817f895c03f2b479f85d3985039f9eccac825e39e047783e53019114a6c07dd63936d088
SSDEEP

12288:XKzDOXddumgKe/BxYkFgV6fWcqYfY+128g6NzVkR:XKzKj7MBWkFgCWbYfe8HXc

Score

10^/10

Malware Config

Targets

- Target
  
  f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
- Size
  
  1.3MB
- MD5
  
  840eb9e50c131322605c5ea90ae1312f
- SHA1
  
  fc9548f91123e05196dad6bcab11d29abd01500c
- SHA256
  
  f9600b1b06588e3815a55eb81e35289f7b9a5749ae623550734c5f3d8c04e038
- SHA512
  
  8e37c5890089bf1997e1c4c777a92f71eae9a86f11d1fb3cb3671dfa8c15c4365ed1f8811e6aae4d31f0fe73c1960b142f684a5274f086491f7d238a79313ffe
- SSDEEP
  
  12288:75gafkW6xqP9iz8ZW29ohk3qHS/6gOHeA/MBU/7x5qDyNjC9Ha1DKs5y6blZRjHe:7Db/s/MSldTzfY/YRSv225PUXW8iF
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (188) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2