Overview

overview

10

Static

static

10

ransomware...TE.exe

windows7-x64

10

ransomware...TE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ransomware DO NOT EXECUTE.exe

  • Size

    248KB

  • Sample

    250114-q24afazjfz

  • MD5

    fe3ac4694dfe15762f09f902f1bf5fd3

  • SHA1

    a3ee731f0e44167c63429f776b30ed1c38204e92

  • SHA256

    1c46cde332afed277986eaae2d50dc288ecd052735235b35962adb21202bb354

  • SHA512

    0669f7328281de827a2bc975f174a985e6b4fbbc4b0cf599b6fea29f92d4633d6c7285049f9c52d39706282a5c1a3c34f2b1fd21e8515ef7fe2dd7a8711045ee

  • SSDEEP

    1536:Oo2ylT90mr9xV46YE63xzqPTosYCXb2CmVjstPYDkuH:OotB90mr9xV41E6lOomaRg2Dk

Score
10/10
chaosransomwarespywarestealer

Malware Config

Targets

    • Target

      ransomware DO NOT EXECUTE.exe

    • Size

      248KB

    • MD5

      fe3ac4694dfe15762f09f902f1bf5fd3

    • SHA1

      a3ee731f0e44167c63429f776b30ed1c38204e92

    • SHA256

      1c46cde332afed277986eaae2d50dc288ecd052735235b35962adb21202bb354

    • SHA512

      0669f7328281de827a2bc975f174a985e6b4fbbc4b0cf599b6fea29f92d4633d6c7285049f9c52d39706282a5c1a3c34f2b1fd21e8515ef7fe2dd7a8711045ee

    • SSDEEP

      1536:Oo2ylT90mr9xV46YE63xzqPTosYCXb2CmVjstPYDkuH:OotB90mr9xV41E6lOomaRg2Dk

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Renames multiple (204) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks