General

  • Target

    1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

  • Size

    610KB

  • Sample

    210906-hhm54safa3

  • MD5

    deb8f4311fd52319f6168c10b626c808

  • SHA1

    f4807d71a1048d05815a09b74997f338e26ba9ff

  • SHA256

    1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

  • SHA512

    ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Ransom Note
All your files have been encrypted !! Don't panic please ! We are here to help you. If you don't want to cooperate and hear your mind instead of our instructions, you will loose stupidly your files but even worse, we are able to kill your main windows process so you will never be able to restart your machine after. All your network may have been infected. If this is the case, note that the decryption software we will give you for one of the machine can be used on all the infected machines. That said, note also that if you don't pay, its all your machines that will get lost and kill. Fortunately, we think you are aware that we don't want this case to happens and you too. That's why to help you, we writed a list of instructions to follow if you want to restore your files. Once you completed all the instructions below, we will be able to give you the decryption software. We don't want to loose time or play with you, we guarantee that you will get that key if you complete your job. Don't be stupid !! To restore your files, you will need to pay a ransom within 62 hours or you will loose everything. The amount requested is 280 dollars. An amount you will need to pay in monero (XMR) which is a cryptocurrency like bitcoin (BTC). Our monero ID (adress where you need to send the money) is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 We encrypted your files with AES-256 encryption method. It's the strongest encryption method you can find in this world. Again, don't be stupid and pay the ransom. Its the only way to get all things to normal. Steps (instructions) to follow : Step 1 : Search localmonero in your browser search bar and click in the first result. Step 2 : Create an account. Step 3 : Search an offer (of a reliable vendor with lot of sales) that correspond to your payment method. Step 4 : Pay 280 dollars at once. Step 5 : Go into your account wallet and you'll see the amount of monero you have paid (it need to be 280 dollars). Step 6 : Send all the monero to our monero ID (adress) which is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 Please, copy-paste it carefully !! Verify if it correspond completly to the one in this text file before you send the money !! Once you send, it will take maximum 30 minutes to recieve. When, we will recieve the payment, we will send you the decryption software by email Please contact us at for help and negociation : RansHelp@tutanota.com Thanks.
Emails

RansHelp@tutanota.com

Targets

    • Target

      1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

    • Size

      610KB

    • MD5

      deb8f4311fd52319f6168c10b626c808

    • SHA1

      f4807d71a1048d05815a09b74997f338e26ba9ff

    • SHA256

      1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

    • SHA512

      ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Defense Evasion

File Deletion

3
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

4
T1490

Defacement

1
T1491

Tasks