Extracted

• • Target

    Bloody Kmax.exe

  • Size

    7.4MB

  • MD5

    cde22b810942c0c6eef2e844a2fe8eae

  • SHA1

    633ec7f9defbda8c7045f69e0a5ac1654068def6

  • SHA256

    c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40

  • SHA512

    e666fd809335888e4cf725e45f10fc7353dd3801a703f39353985b7ef35c6de1915abb22a54b4b1608fee86dd1c1c7b6c7b0b9d5215910164e1fb2469c32e58a

  • SSDEEP

    24576:aaL3vVD8Lpq5u+B0cAUmhInhvctethPLqrzHBCBoNyUr4epjVGXWkY6V5vovNYiw:L9gvS3thO/EabZkY6LVm6fiMhZnLDUR

  Score

  10^/10

  chaosdiscoveryevasionransomwarespywarestealeradwarepersistenceprivilege_escalation

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Chaos family

    chaos

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2