Overview

overview

10

Static

static

10

testttsa.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    testttsa.exe

  • Size

    104KB

  • Sample

    241119-cnxc3syela

  • MD5

    cfbf0711aaec84a0a3e73b2ccb8dc9bf

  • SHA1

    ec87d3a01063b5e27b09bbd5f024c43bd4a92cf3

  • SHA256

    2dad9fdc3ba592a020bd90c0fc11feeb1f9cf228c9d0c1c647fdbf8a3d7064ce

  • SHA512

    ef032094b3e4b308a2acc974555230f0265afc8ff0d580a6e0f5352e3cc5b0a9884d8de851ac495706da48c8969afbc81d39e41087f714ba0bc62a71f70a1bd2

  • SSDEEP

    1536:po2GCqr9IphA2AZyCeoetR8cGsgzCtRyEc1CvHSHyIBCHVF0suFf9:poVCqr9ILA2t/CZb3z1CvHSHyLm9

Score
10/10
chaosdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      testttsa.exe

    • Size

      104KB

    • MD5

      cfbf0711aaec84a0a3e73b2ccb8dc9bf

    • SHA1

      ec87d3a01063b5e27b09bbd5f024c43bd4a92cf3

    • SHA256

      2dad9fdc3ba592a020bd90c0fc11feeb1f9cf228c9d0c1c647fdbf8a3d7064ce

    • SHA512

      ef032094b3e4b308a2acc974555230f0265afc8ff0d580a6e0f5352e3cc5b0a9884d8de851ac495706da48c8969afbc81d39e41087f714ba0bc62a71f70a1bd2

    • SSDEEP

      1536:po2GCqr9IphA2AZyCeoetR8cGsgzCtRyEc1CvHSHyIBCHVF0suFf9:poVCqr9ILA2t/CZb3z1CvHSHyLm9

    Score
    10/10
    chaosdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks