Overview

overview

10

Static

static

10

Solara V3.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solara V3.exe

  • Size

    280KB

  • Sample

    250220-zk5xdawnz2

  • MD5

    ce2de0ede14e0b143ac05634799fea77

  • SHA1

    d466b46837a9af03b9c503bccf6d8b97c5ec9d9b

  • SHA256

    48719bdc85157f9911c11709e6fd50e4f57b58a6a9e34ddc2084883d2c04c77a

  • SHA512

    cf6afcb1da1020aa1221cac9dc91197ae4e5f41c3d29bb386a7e6849f61f7b198d82f4c9dd9d5a428aed3d54e592796d960b893a4243d734332a712af6688624

  • SSDEEP

    6144:Cc9pXH6pTJIIczuVf2Qpm7U5jX/KBTvdwFyWKSL4/gCiH:LH6pTJ3c6Vf2QpmINX/KBTvdwFrKSL4S

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      Solara V3.exe

    • Size

      280KB

    • MD5

      ce2de0ede14e0b143ac05634799fea77

    • SHA1

      d466b46837a9af03b9c503bccf6d8b97c5ec9d9b

    • SHA256

      48719bdc85157f9911c11709e6fd50e4f57b58a6a9e34ddc2084883d2c04c77a

    • SHA512

      cf6afcb1da1020aa1221cac9dc91197ae4e5f41c3d29bb386a7e6849f61f7b198d82f4c9dd9d5a428aed3d54e592796d960b893a4243d734332a712af6688624

    • SSDEEP

      6144:Cc9pXH6pTJIIczuVf2Qpm7U5jX/KBTvdwFyWKSL4/gCiH:LH6pTJ3c6Vf2QpmINX/KBTvdwFrKSL4S

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks