Extracted

Extracted

Extracted

Extracted

• • Target

    38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0.exe

  • Size

    244KB

  • MD5

    bae6c0faa24fda3118cfdfc7f3f2553d

  • SHA1

    e6592d7122a73fda5f9cd98b5e49d5d80f0fe4fe

  • SHA256

    38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0

  • SHA512

    e400e14ba2e16d4ac197e2d99407142a48d3a8027faf12d1268c2f8bd293a00dec03e9e3d760e246a3b538b75754488e2a0e2d074d2f11fa775cfdd99b8ea0e9

  • SSDEEP

    6144:8+jn7PfWDycKPudCuS74kvw6Mr9zmduLn+70pKXQl29ur4cm:8+gycSzre2q+70pKXQl29ur4c

  Score

  10^/10

  chaosdiscoverypersistenceransomware

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4

• • Target

    3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7.exe

  • Size

    18KB

  • MD5

    50f4469ad4b9bf352c5c9604ef913ccf

  • SHA1

    5c82d5155c9151115346efd94e1b1da34cced32c

  • SHA256

    3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7

  • SHA512

    ff92408fd18d0a7563705e606a9534ebc47f6e85b3dd2aa439da58f85c32c8107dd2d5985aca91d7c0c3cb604ef7d5758469e8efc77d033a66148b3a8731be3e

  • SSDEEP

    384:vRHTIhveCy+RujQKK7qbqtLnWp9Iggf7W8:vRTIry+Ru0KKObh9IggfL

  Score

  9^/10

  defense_evasionexecutionimpactpersistenceransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (1382) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral5behavioral6behavioral7behavioral8

• • Target

    801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe

  • Size

    18KB

  • MD5

    f31d6529ff4ad98053f9a8a9832f95e3

  • SHA1

    abdd5ce48e2d11a4c82fc90d9e9beeb14b437cee

  • SHA256

    801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e

  • SHA512

    25e452098a46f3ddf3cc6e268a94fa998d7c0de907741f436d10caf7be8c038163dc3a0f51516f3b4072085951eb5e44053b2e9f84a532c152bbf813a518a755

  • SSDEEP

    384:imwIxiBDXgRUV7JCGgmxt8mvA4ILbfNGHEDPUw3rXTXLazK:i6UVl7twPbfg2Uw3HXAK

  Score

  9^/10

  defense_evasionexecutionimpactransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (495) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral10behavioral11behavioral12behavioral9

• • Target

    be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe

  • Size

    244KB

  • MD5

    751df604e41a7e473fd3817b4c16d5f6

  • SHA1

    30d6eacf97d1a5e6ec191f75a8eb16d9da54f218

  • SHA256

    be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e

  • SHA512

    6c546d46e6b7c0adffee2bdcf2b85b786b57fbf73c4213e39bf54e4ceaceaa5f143e0e9d57d0398464074e46c0242bd649fa80615d1dc3db32f08b061a7629d7

  • SSDEEP

    6144:8+jn7PfWDycKPudCuS74kvw6Mr9zmduLb+70pKXQl29ur4cm:8+gycSzre2q+70pKXQl29ur4c

  Score

  10^/10

  chaosdiscoverypersistenceransomware

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral13behavioral14behavioral15behavioral16

• • Target

    ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe

  • Size

    52KB

  • MD5

    ba9210de03de945901f02792f7994871

  • SHA1

    20c4569cbb6f2650b02f6a5257faa8a8dfb298bd

  • SHA256

    ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d

  • SHA512

    277d26eea627b3da26664aaa4f72a7b79cd50311e45c59333563b4f58b76e6562cbaa1d55127c69d0830864721efa890fa824e1be381cca5e84bddc98f2b44d0

  • SSDEEP

    1536:EJJRZQJes5b0k5bbyu6hXOKJrkH6sNNW:oJRa4kLmNVOKJIasNE

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral17behavioral18behavioral19behavioral20