Overview

overview

10

Static

static

10

PepperX (2).exe

windows7-x64

10

PepperX (2).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PepperX (2).exe

  • Size

    81KB

  • Sample

    241125-t8necasnar

  • MD5

    b950502f66e5c9b058f340ab24b3b5ab

  • SHA1

    fad3abdf88ef351b25ef339a6d1a082d8516b9e9

  • SHA256

    d45f6608d6afc48189e0ef63e489f9034cd3e864a95d634640df53ad302b42b3

  • SHA512

    132235bf2ad67b8b22428e716a27d35b024c38ca09e770237688b4d4e88eb4f44a98b267c068f422aa75a6050bfff3db6073bc71619b5bb85fb76ddf9833a5f9

  • SSDEEP

    1536:w3kIZ4nmr9iW2wU3gUvpdO0J//E2dLEgtMRloDpU:w3kI4nmr9iY7MhdHMRl6pU

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      PepperX (2).exe

    • Size

      81KB

    • MD5

      b950502f66e5c9b058f340ab24b3b5ab

    • SHA1

      fad3abdf88ef351b25ef339a6d1a082d8516b9e9

    • SHA256

      d45f6608d6afc48189e0ef63e489f9034cd3e864a95d634640df53ad302b42b3

    • SHA512

      132235bf2ad67b8b22428e716a27d35b024c38ca09e770237688b4d4e88eb4f44a98b267c068f422aa75a6050bfff3db6073bc71619b5bb85fb76ddf9833a5f9

    • SSDEEP

      1536:w3kIZ4nmr9iW2wU3gUvpdO0J//E2dLEgtMRloDpU:w3kI4nmr9iY7MhdHMRl6pU

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks