General

  • Target

    230726-rv6mnadf4v

  • Size

    953KB

  • Sample

    240312-mayn4aee4v

  • MD5

    adb3dde4a25e596c16ced4cdfc6ff8dd

  • SHA1

    7934e6bc9489933c0af8dfe7bdff482fc6759bdc

  • SHA256

    8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44

  • SHA512

    f14c27892ed4d11bdd46a130abc7fa40ae8c4577bcd45c3af7c5928b82f27c3646b906fda880e5c9df623071edaab8de82fd46af8f3194f33d7d46c2c3d1d587

  • SSDEEP

    12288:vEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzzjc:/ztQE1ov2AZ9HjkftWy3P

Malware Config

Extracted

Path

C:\Users\Admin\Documents\PLEASEREAD.txt

Ransom Note
WELCOME, DODO has returned AGAIN. Your files have been encrypted and you won't be able to decrypt them. You can buy decryption software from us, this software will allow you to recover all of your data and remove the ransomware from your computer. The price of the software is $15. Payment can be made in Bitcoin or XMR. How do I pay, where do I get Bitcoin or XMR? Purchasing cryptocurrency varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin or XMR. Payment information: send $15, to one of our addresses, then send us email with payment confirmation and you'll get the decryption software in email. Email Address : [email protected] BTC address: bc1qsht77cpgw7kv420r4secmu88g34wvn96dsyc5s XMR address: 44GUTQ7WqysSjLDCXfTnsYLCVJNGp67AECA9kTrAvjYCNz3ScZkYXZKP2EbR3DfbXPUYw6bMkaBuYCd6PdJCYngr4WtCeFt

Targets

    • Target

      230726-rv6mnadf4v

    • Size

      953KB

    • MD5

      adb3dde4a25e596c16ced4cdfc6ff8dd

    • SHA1

      7934e6bc9489933c0af8dfe7bdff482fc6759bdc

    • SHA256

      8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44

    • SHA512

      f14c27892ed4d11bdd46a130abc7fa40ae8c4577bcd45c3af7c5928b82f27c3646b906fda880e5c9df623071edaab8de82fd46af8f3194f33d7d46c2c3d1d587

    • SSDEEP

      12288:vEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzzjc:/ztQE1ov2AZ9HjkftWy3P

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Detects command variations typically used by ransomware

    • Modifies boot configuration data using bcdedit

    • Renames multiple (212) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks