Overview

overview

10

Static

static

10

a80908bcd9...67.exe

windows7-x64

10

a80908bcd9...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2023 01:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267.exe

  • Size

    2.7MB

  • MD5

    028d8a0f2eefdc87bcfde1457470789c

  • SHA1

    a9f41548d827728e44cb0296b05ae23295698c46

  • SHA256

    a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267

  • SHA512

    931b9ddeba173931968f80d144a3fd851236744c12212a6e723c88ffd7c720b7ec2538b655fe680a80c66d65a3ca541bcbbf3abfd1e353eef0dfb2fa3d9594f5

  • SSDEEP

    24576:bvS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:bvSy6PX3PpM+P5Id

Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\How to Recovery.bat

Ransom Note
echo off color 0a cls :MENU ECHO. ECHO -----------------Attention----------------- ECHO. ECHO. Your All Files Have been Encrypted! ECHO. ECHO Your Personal files (Documents, Databases, All Drive, PDF, ETC.) We re encrypted. ECHO. But don't worry about your files,You can take back all of them, To decrypt your all files need ECHO. to buy Our Software With your unique private key. Only our software well allow decrypt your files. ECHO. Remember if you try to recovery your files through any third-party software, ECHO. it's can cause premature damage to your files, and we can't help you either. ECHO. ECHO. -----------------Note!----------------- ECHO. ECHO. You have only 72 hours from the moment when an encryption was done to buy our software at $200 for the payment ECHO. ECHO. BTC Address:- 33j4JbAEzZwWGgA2MxBARD7zprJuNDP2hP ECHO. ECHO. And if you Payment complete then Send me proof. ECHO. ECHO. Use the following ID as the title of your email:- QA2Z67DXLBFF05FHN ECHO. ECHO. Use these emails to contact us and receive instructions:- ECHO. ECHO. Main email:- [email protected] ECHO. ECHO. Secondary email ( in case of no response in 48h):- [email protected] ECHO. ECHO. Also, you can send up to 3 test files to see if we can decrypt your files. ECHO. ECHO. After paying, the decryptor software and your private key will be given to you. ECHO. SET /P M=
Wallets

33j4JbAEzZwWGgA2MxBARD7zprJuNDP2hP

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267.exe
    "C:\Users\Admin\AppData\Local\Temp\a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:3980
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4868
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2872
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:816
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\How to Recovery.bat" "
        3⤵
          PID:1464
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4716
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4600
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1948
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1344

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Roaming\How to Recovery.bat
        Filesize

        1KB

        MD5

        f3c81a8f85b58d848f304a3823d2478a

        SHA1

        5f2a1454234bdf49ce149c2a7d3d27d45adc0237

        SHA256

        930458232b00ce183a7803bac9097afe4b94ea29beea5552546926bfe4249c58

        SHA512

        f5833ef930963dd07125e2ec81b86c0c8f6dfa18a28c2a4356df2097d7c6a960cd0182b39834c01341685d3245bc5bd70f5815f473af84c50d5d9ee5cfa93aca

        Download Submit

      • C:\Users\Admin\AppData\Roaming\svchost.exe
        Filesize

        2.7MB

        MD5

        028d8a0f2eefdc87bcfde1457470789c

        SHA1

        a9f41548d827728e44cb0296b05ae23295698c46

        SHA256

        a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267

        SHA512

        931b9ddeba173931968f80d144a3fd851236744c12212a6e723c88ffd7c720b7ec2538b655fe680a80c66d65a3ca541bcbbf3abfd1e353eef0dfb2fa3d9594f5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\svchost.exe
        Filesize

        2.7MB

        MD5

        028d8a0f2eefdc87bcfde1457470789c

        SHA1

        a9f41548d827728e44cb0296b05ae23295698c46

        SHA256

        a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267

        SHA512

        931b9ddeba173931968f80d144a3fd851236744c12212a6e723c88ffd7c720b7ec2538b655fe680a80c66d65a3ca541bcbbf3abfd1e353eef0dfb2fa3d9594f5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\svchost.exe
        Filesize

        2.7MB

        MD5

        028d8a0f2eefdc87bcfde1457470789c

        SHA1

        a9f41548d827728e44cb0296b05ae23295698c46

        SHA256

        a80908bcd96a8df6070eb9a9c83739c8d95c34d7d81b890bacda91bb05c53267

        SHA512

        931b9ddeba173931968f80d144a3fd851236744c12212a6e723c88ffd7c720b7ec2538b655fe680a80c66d65a3ca541bcbbf3abfd1e353eef0dfb2fa3d9594f5

        Download Submit

      • C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk
        Filesize

        1B

        MD5

        d1457b72c3fb323a2671125aef3eab5d

        SHA1

        5bab61eb53176449e25c2c82f172b82cb13ffb9d

        SHA256

        8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

        SHA512

        ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

        Download Submit

      • C:\Users\Default\How to Recovery.bat
        Filesize

        1KB

        MD5

        f3c81a8f85b58d848f304a3823d2478a

        SHA1

        5f2a1454234bdf49ce149c2a7d3d27d45adc0237

        SHA256

        930458232b00ce183a7803bac9097afe4b94ea29beea5552546926bfe4249c58

        SHA512

        f5833ef930963dd07125e2ec81b86c0c8f6dfa18a28c2a4356df2097d7c6a960cd0182b39834c01341685d3245bc5bd70f5815f473af84c50d5d9ee5cfa93aca

        Download Submit

      • memory/840-133-0x0000000000B20000-0x0000000000DDC000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/840-134-0x00000000030E0000-0x00000000030F0000-memory.dmp

        Filesize

        64KB

        Download