Overview

overview

10

Static

static

10

Random.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Random.exe

  • Size

    32KB

  • Sample

    240812-al7pxswdpq

  • MD5

    aec65cd697c52926d76f888c0f1958b2

  • SHA1

    603b2537703cfc6c4addf8ef1480ce33601f6117

  • SHA256

    438764714bb650393cdeba7bfa9e0ba039cd566fc35e4565dc2855d1e086f16d

  • SHA512

    c1a5d23b5cd9b378a6031c6ca1bfe65da424bb60c9e404401ca139eee1a3e6f78fc1bae1f38e493ccd3fcaa7b905b6caab2a36d19648acf76e63874df48278a4

  • SSDEEP

    384:h3MLWHn3kI9a0JI8ITMpypoGroX3Jxr91CppZkM5hEM5eF:hn3kItJInTMpxMs5xr9OpZkM5hE2eF

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      Random.exe

    • Size

      32KB

    • MD5

      aec65cd697c52926d76f888c0f1958b2

    • SHA1

      603b2537703cfc6c4addf8ef1480ce33601f6117

    • SHA256

      438764714bb650393cdeba7bfa9e0ba039cd566fc35e4565dc2855d1e086f16d

    • SHA512

      c1a5d23b5cd9b378a6031c6ca1bfe65da424bb60c9e404401ca139eee1a3e6f78fc1bae1f38e493ccd3fcaa7b905b6caab2a36d19648acf76e63874df48278a4

    • SSDEEP

      384:h3MLWHn3kI9a0JI8ITMpypoGroX3Jxr91CppZkM5hEM5eF:hn3kItJInTMpxMs5xr9OpZkM5hE2eF

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks