General
- Target https://github.com/pankoza2-pl/malwaredatabase-old/blob/main/Covid29-Ransomware/Covid29%20Ransomware.zip
- Sample240808-3lsvzssdmk
Malware Config
Targets
-
- Target https://github.com/pankoza2-pl/malwaredatabase-old/blob/main/Covid29-Ransomware/Covid29%20Ransomware.zip
Score10/10Chaos
Ransomware family first seen in June 2021.
Chaos Ransomware
UAC bypass
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Disables Task Manager via registry modification
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
3File Deletion
3Modify Registry
3Pre-OS Boot
1Bootkit
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1