Analysis
-
max time kernel
178s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11/02/2022, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe
-
Size
314KB
-
MD5
9ccf43bbfaccb1a377e0b87f3f7f538c
-
SHA1
91d70b30f9232435776d0f6839f6ff7ac4fb586d
-
SHA256
0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56
-
SHA512
64373dc9798701747581c01bb21c4ba672c948e4232b4d1db8ec6a492581147451e31509a3e3f2be647fd4cea95783b4c83f7764f181508ae20c4887001a672c
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\read_me.txt
Ransom Note
----> SHQ is multi language ransomware. Translate your note to any language <----
All of your files have been encrypted
Your computer was infected with a ransomware virus. Your files have been encrypted and you won't
be able to decrypt them without our help.What can I do to get my files back?You can buy our special
decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.The price for the software is $42,899.40. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com
Payment informationAmount: 1337.00 BTC
Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral2/memory/4220-131-0x00000000005B0000-0x0000000000604000-memory.dmp family_chaos behavioral2/files/0x000600000001e721-133.dat family_chaos behavioral2/files/0x000600000001e721-132.dat family_chaos -
Executes dropped EXE 1 IoCs
pid Process 1532 svchost.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConvertFromClose.raw => C:\Users\Admin\Pictures\ConvertFromClose.raw.shq svchost.exe File renamed C:\Users\Admin\Pictures\UnprotectLock.raw => C:\Users\Admin\Pictures\UnprotectLock.raw.shq svchost.exe File renamed C:\Users\Admin\Pictures\UnregisterConvertTo.tif => C:\Users\Admin\Pictures\UnregisterConvertTo.tif.shq svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_me.txt svchost.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe Token: SeDebugPrivilege 1532 svchost.exe Token: SeShutdownPrivilege 4228 svchost.exe Token: SeCreatePagefilePrivilege 4228 svchost.exe Token: SeShutdownPrivilege 4228 svchost.exe Token: SeCreatePagefilePrivilege 4228 svchost.exe Token: SeShutdownPrivilege 4228 svchost.exe Token: SeCreatePagefilePrivilege 4228 svchost.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe Token: SeBackupPrivilege 3544 TiWorker.exe Token: SeRestorePrivilege 3544 TiWorker.exe Token: SeSecurityPrivilege 3544 TiWorker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4220 wrote to memory of 1532 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 87 PID 4220 wrote to memory of 1532 4220 0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe"C:\Users\Admin\AppData\Local\Temp\0a144c8c7a27b14415064cf3e8a031fa19b59970427c1d00b9bf4a129fc94c56.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3544