chaos

General

Target

OhioTax.exe
Size

356KB
Sample

241229-tv7aasvkan
MD5

c7b696a87ebd99919eb5ad685c38e565
SHA1

b405dc2e87089b0294debdcaeb445a09d3bc2247
SHA256

608ffc0b1e989e29b454389a9807e3721c075a2334d7d51765b5adad589fa0ef
SHA512

94e1711f62755e1a838d4c03530111054bd4a5b58b47660d2fc46fe059e1e7997dc6d5042afd8d3273e64d6fd258f0fc3ffd6120308a96fc09a9c0b79973e80e
SSDEEP

6144:URq9gVZ8CMci9haFy43XbyvtDAwz4e/VE/YbFwrSMiinNzP4U:U7SZciTaw4Hbyhz4uVEgbFQzPx

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  OhioTax.exe
- Size
  
  356KB
- MD5
  
  c7b696a87ebd99919eb5ad685c38e565
- SHA1
  
  b405dc2e87089b0294debdcaeb445a09d3bc2247
- SHA256
  
  608ffc0b1e989e29b454389a9807e3721c075a2334d7d51765b5adad589fa0ef
- SHA512
  
  94e1711f62755e1a838d4c03530111054bd4a5b58b47660d2fc46fe059e1e7997dc6d5042afd8d3273e64d6fd258f0fc3ffd6120308a96fc09a9c0b79973e80e
- SSDEEP
  
  6144:URq9gVZ8CMci9haFy43XbyvtDAwz4e/VE/YbFwrSMiinNzP4U:U7SZciTaw4Hbyhz4uVEgbFQzPx
Score

10^/10

chaos defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1