Overview

overview

10

Static

static

10

a7f09cfde4...9b.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    75s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2022, 21:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.exe

  • Size

    26KB

  • MD5

    cf6ff9e0403b8d89e42ae54701026c1f

  • SHA1

    a4f5cb11b9340f80a89022131fb525b888aa8bc6

  • SHA256

    a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b

  • SHA512

    dca369de908ff4d8a6b095243d8837ad9eb885c78544565586196451f99303e9beb8635e01254514b485f22298b3eaf69afb3666b6032959ae3e9567e78dc575

  • SSDEEP

    384:Uo3Mg/bqo25M0RHcY5pmyjuwzUHJhr91CHW8wNa9get:UWqo2Zn5pPjKphr9z8wNHet

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Ransom Note
All of your files are currently encrypted by ONYX strain. As you already know, all of your data has been encrypted by our software. It cannot be recovered by any means without contacting our team directly. DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However, if you want to try - we recommend choosing the data of the lowest value. DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. DON'T TRY TO CONTACT feds or any recovery companies. We have our informants in these structures, so any of your complaints will be immediately directed to us. So if you will hire any recovery company for negotiations or send requests to the FBI, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately. To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://ibpwmfrlbwkfd4asg57t4x2vkrczuq3uhrfxf6y35xoalwjlztil54ad.onion Login: ampkcz Password: fgh5RgsW73F YOU SHOULD BE AWARE! We will speak only with an authorized person. It can be the CEO, top management, etc. In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm!
URLs

http://ibpwmfrlbwkfd4asg57t4x2vkrczuq3uhrfxf6y35xoalwjlztil54ad.onion

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.exe
    "C:\Users\Admin\AppData\Local\Temp\a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops startup file
      • Drops desktop.ini file(s)
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\readme.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2512

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\readme.txt
          Filesize

          1KB

          MD5

          b402046c86e08ea9c4b10b7557ba3d44

          SHA1

          2db4472bd804e9732801d4b9aab6fb7ada46f4e6

          SHA256

          82086da6a81e6606c29af9744461ccbdf6735cb1c3899383c83d07253426944f

          SHA512

          eca57607191fc0bcb39c69f80e8c7601cf7268c596e5d6d5f262e7bbc70dd6e4c8d2d490af3c4b841d8fb4b94d7c069ab33c345f70a93652f3ffa2e62b9a6e75

          Download Submit

        • C:\Users\Admin\AppData\Roaming\svchost.exe
          Filesize

          26KB

          MD5

          cf6ff9e0403b8d89e42ae54701026c1f

          SHA1

          a4f5cb11b9340f80a89022131fb525b888aa8bc6

          SHA256

          a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b

          SHA512

          dca369de908ff4d8a6b095243d8837ad9eb885c78544565586196451f99303e9beb8635e01254514b485f22298b3eaf69afb3666b6032959ae3e9567e78dc575

          Download Submit

        • C:\Users\Admin\AppData\Roaming\svchost.exe
          Filesize

          26KB

          MD5

          cf6ff9e0403b8d89e42ae54701026c1f

          SHA1

          a4f5cb11b9340f80a89022131fb525b888aa8bc6

          SHA256

          a7f09cfde433f3d47fc96502bf2b623ae5e7626da85d0a0130dcd19d1679af9b

          SHA512

          dca369de908ff4d8a6b095243d8837ad9eb885c78544565586196451f99303e9beb8635e01254514b485f22298b3eaf69afb3666b6032959ae3e9567e78dc575

          Download Submit

        • memory/1616-118-0x0000000000D70000-0x0000000000D7C000-memory.dmp

          Filesize

          48KB

          Download