Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
General
-
Target
002.7z
-
Size
11.2MB
-
Sample
240805-eee4jszepd
-
MD5
82180da2d9ecde4947a618ff1a37fdad
-
SHA1
ae327ea9229498e86afb337b87cf6d6f4caaa309
-
SHA256
cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278
-
SHA512
606ddfb833eb38952403ae10e9eec694d45e3fb2df326d5825f93257d605552868343e80fd6e3a497d690dabe8ed1493b60843118f1aa5412be8cc55a66335a3
-
SSDEEP
196608:nYcNyJpHBLBc6gKWYZzbK26sqaddXpgPxydfcNQChzHayMxpJ51LipiFe5TZD0B:n5yJ1pB+KWYtbK26sq25GyxcR6yMt51L
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Admin\Documents\Fucking_it.txt
3LrDFbp6fRqkXE45bLipnrQNg9wMKyTR5S
https://t.me/usnexushacker
https://www.propub3r6espa33w.onion
Extracted
C:\Users\ooxlOmJxX.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Extracted
C:\ooxlOmJxX.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Extracted
C:\Users\Admin\How To Restore Your Files.txt
darkside
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
-
Size
155KB
-
MD5
7e3b2b10d66955465c12da9f2ab43e36
-
SHA1
2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380
-
SHA256
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550
-
SHA512
ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0
-
SSDEEP
3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL
Score3/10 -
-
-
Target
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
-
Size
79KB
-
MD5
f9afb31bc17811e5ab4fa406f105b1fe
-
SHA1
d1a9449dcc8a3aa0c887bce71f128866175f679a
-
SHA256
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f
-
SHA512
6feca3dfa221b704208754e67bcdce02a2253961da098b3e376d11217cd00b9f77e42f37f242e1a1f4b759b5fd172c29c9f153fce32eace48e07e802aff40b55
-
SSDEEP
1536:SX6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
-
Size
70KB
-
MD5
58d6eab3aafd9139a2f1c7606ecd4cef
-
SHA1
4152a7431b3d5dd8b0f6ad08148cb166315f41e9
-
SHA256
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6
-
SHA512
ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49
-
SSDEEP
1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
Score6/10-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
-
Size
92KB
-
MD5
786ce74458720ec55b824586d2e5666d
-
SHA1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
-
SHA256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
-
SHA512
083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
-
-
Target
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
-
Size
92KB
-
MD5
a23219bddf6b154ca2f5afa89cb2b0c3
-
SHA1
0d63eb57023770b53b6b31f669a03bbdb7a2465b
-
SHA256
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9
-
SHA512
65583cfa9c2d77330e15a5bfce430831b53bf1b018757fa8778618bef44b87b15d20a9bbcd80a1526bb6c582df3b8ff55f0cc7b002c4a1655c3f1ace01d54172
-
SSDEEP
1536:tBwl+KXpsqN5vlwWYyhY9S4AYgfEHB0tRYn+9jsGGqbg8IIvoBec5wOmh:Hw+asqN5aW/hLmDHyt0KaIvogn
Score1/10 -
-
-
Target
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
-
Size
2.0MB
-
MD5
fa06e6aadef2365052156f12c92d7b09
-
SHA1
82de91795547028be327e75cee0fdf082352bfc9
-
SHA256
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
-
SHA512
1629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
-
SSDEEP
24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
-
-
Target
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
-
Size
155KB
-
MD5
f70cabb50328b089d00f82808f7e2563
-
SHA1
9fd6765c2a42120042dd437fcb4468a448c64725
-
SHA256
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e
-
SHA512
baf5abd87d7267d1b89b9779c2781604bbcdba40afab2fe4e43bd6ddb0500c89f3502a879503d6b0303da2aa169420cbd8e3ca7c85efa8604b127171c6234cec
-
SSDEEP
3072:S5K/B0toLQSNJwlxwsx89TSdBgjMqqDL2/TOKyRGA:ScytwtLTTSdBgQqqDL6SKNA
Score3/10 -
-
-
Target
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
-
Size
432KB
-
MD5
7da83e0a63039ac6aec5b8cbc31d20d6
-
SHA1
6b1d7db9600cc88922b9a213f7b30f29fe5bc20e
-
SHA256
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db
-
SHA512
f988d36e9e67b2c8ef70968edd3de817614cf20a3a6041d77c627501186b36b4a6904e51acce876f772f0593975af1d2e50e882ba562a79c24a2ee6e1b5f0ac6
-
SSDEEP
12288:iKPmrLbovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSi
Score3/10 -
-
-
Target
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
-
Size
490KB
-
MD5
2d23c83d6941cf484da19d4367c02df0
-
SHA1
b63dd1f2e35d8944dee745321643f06037dfe95e
-
SHA256
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89
-
SHA512
28a5d2df80e9a1c5eeb65938479b7b96f754feff28244f91304361bd4c238d533f01d37598eedc95c6549c9066c8f15b2ce16262e02ce944dd47ed6e123ef797
-
SSDEEP
12288:wIOfQgbI1D/Tj7MACdotmELTtqGJouy9JtsmRrTNaTI7rERFUZ1K1s9L01:rt0v4yPpS
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
-
-
Target
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
-
Size
362KB
-
MD5
2e81a8097ac6d1902db1f74863b41c39
-
SHA1
4b3a78491246f78566ec444a1c22226746a53a21
-
SHA256
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d
-
SHA512
bcf78e32b58e559bc06067aa360630e6ac85cb9b1f120580b93c2c1e3ae051590eb406c8650bee122970d105e3359f27e6f85b2dd60da2c69ea762dc2c600b49
-
SSDEEP
6144:siW7SDayqQXtokkfP6MyMQZVHewrBtM70H4dy/lrDJYgQ1qUbfc:liwdvmqVxrrlrDygfV
Score3/10 -
-
-
Target
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
-
Size
159KB
-
MD5
ef577a1a486aa3dba1b0acd46b54d3a6
-
SHA1
24897bc96bec3126c4a65c96b907fe57bd75359f
-
SHA256
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
-
SHA512
9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
-
SSDEEP
3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
-
Size
179KB
-
MD5
c2fea37aa19c947614c20fe2ad3aeef2
-
SHA1
16834915e3db38b5b954c2099d77bcb700428588
-
SHA256
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
-
SHA512
e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
-
SSDEEP
3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-
-
-
Target
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
-
Size
1.2MB
-
MD5
f645b68f97b49c8d120158e7fd7f1460
-
SHA1
b8673e2041966ace9d643106ba2aa1e69c3b9cd7
-
SHA256
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef
-
SHA512
685594d277c7d09649fa5b3b0d363714f524be0116cdedab92b5f617e41c7a40573055f1d20d85eb629feb9e55d324a06e9e6ed7297a78d179108c4f7e57eb36
-
SSDEEP
24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/BRPOO8xGKUq7:F0dwAYZt6C31WeT5RPOhxzUq7
Score1/10 -
-
-
Target
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
-
Size
6.4MB
-
MD5
356388cdb4f74188812fa44c0aef000b
-
SHA1
59130f7b2e63422da6f620fa29cc6837903584cb
-
SHA256
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd
-
SHA512
11ba99f6a151675408f76f4c02d10a80a60f74d6c4e0ef794043d36237b002cf8ab577421758f16fe678f1f190782aba7adbdf33c87693c379dd18e3176dae83
-
SSDEEP
98304:f/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8jHI:f/qPe1Cxcxk3ZAEUadzR8jHI
Score10/10-
Executes dropped EXE
-
Drops file in System32 directory
-
-
-
Target
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
-
Size
2.4MB
-
MD5
84e2bf751724e3b0acc70b67ee1b8e96
-
SHA1
2e1c9638b022901d67c69ef17c6acd12fd6e493f
-
SHA256
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
-
SHA512
56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
-
SSDEEP
12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
Score10/10-
Modifies WinLogon for persistence
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
-
-
Target
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
-
Size
92KB
-
MD5
a3435d1839ded089f36516c52e94f5d3
-
SHA1
ffa7bf12d73d61c7cd09070f2d680c1b0eec4990
-
SHA256
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788
-
SHA512
b3bf2296104cff14836cac3391cb12ee1ca9055673f2855bee45f552bcaf085053d1504ad5d141620e7f4a50ee407bbd8db2844cb32747cb5631efd2daaccd86
-
SSDEEP
1536:tBwl+KXpsqN5vlwWYyhY9S4AwGOFr82UvQJwK:Hw+asqN5aW/hLe3rrJw
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Direct Volume Access
1Indicator Removal
4File Deletion
4Modify Registry
4Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1