chaos | 954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c

General

Target
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
Size 22KB
Sample261028-w2bs3ssz7k
SHA256 954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c
MD5 a4ac3f1674f24c6e596bf71fc47bd275
SHA1 24dbe7a81a5bda771d7557fa3f5000f4a9f27179
SHA512 d75690b60afbc2999d5f2892b6ee924b902a1497f9820393c78edd64c061908462e98593267836bdab28bb9963fc30b4e780f0c7b5853fd067765e3a6df0bdc7
SSDEEP 384:13Mg/bqo2HgkbOnNTYvTppSuqMWLJ1r91CxRQDfem:Pqo2jyZYvTppDA91r9CRQzem
TLSH
T1C5A2E70867FA563DF6FE1EBC2DB250415771B943DD1EE74D2CCE015D0823B8C9A90AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
- Size 22KB
- SHA256 954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c
- MD5 a4ac3f1674f24c6e596bf71fc47bd275
- SHA1 24dbe7a81a5bda771d7557fa3f5000f4a9f27179
- SHA512 d75690b60afbc2999d5f2892b6ee924b902a1497f9820393c78edd64c061908462e98593267836bdab28bb9963fc30b4e780f0c7b5853fd067765e3a6df0bdc7
- SSDEEP 384:13Mg/bqo2HgkbOnNTYvTppSuqMWLJ1r91CxRQDfem:Pqo2jyZYvTppDA91r9CRQzem
- TLSH
  T1C5A2E70867FA563DF6FE1EBC2DB250415771B943DD1EE74D2CCE015D0823B8C9A90AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution chaos impact persistence privilege_escalation ransomware spyware stealer
- Chaos Ransomware
- Family: Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (372) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1