Overview

overview

10

Static

static

10

90b709901d...67.exe

windows7-x64

10

90b709901d...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90b709901d41e0c58923d0124beb345532d7f60a288a7432c8b2f0f0ff37ec67

  • Size

    957KB

  • Sample

    240312-mfz44sge87

  • MD5

    0ba90c8d8c655ee822f19820c7641b6c

  • SHA1

    94b09919d77c1760a003bcd3eee8745f79b5cd25

  • SHA256

    90b709901d41e0c58923d0124beb345532d7f60a288a7432c8b2f0f0ff37ec67

  • SHA512

    8c591016ea0edd78b00ad8cfcf6856e2f2902cbfd7208a3ca2367c0bcfbfdb89a473264d75f742706506e38e3edb0d42bfc627eb16191fe064464ce379c955f4

  • SSDEEP

    24576:Y5pOT/MvD8Un1s2nZkFXfRMwpb645ADkMU:nFYnepM4br5hM

Score
10/10
chaosrevengeratevasionpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\OPEN_ME.txt

Ransom Note
----------National Office of Security Enforcement [N.O.O.S.E] Report---------- *Introduction: National Office of Security Enforcement [N.O.O.S.E] You were infected by a ransomware made by N.O.O.S.E No need to Google us, we only exist when we want to. *What happened? You are infected with the NOOSE ransomware. This version does have an antidot. Your unique ID is: NOOSEVariant2ID3754865400 *I want my data back: To get your data back, you need our decryption software. Which only N.O.O.S.E have. Our software is worth 1540 USD. *About the decryption software: To decrypt your files and data you'll need a private key. Without it, you can't have anything back. Our software uses your safely stored private key to decrypt your precious data. No other softwares can decrypt your data without the private key. *Payment currency: We only accept Monero XMR as a payment method. *Payment information: Price: 9.7 XMR Monero address: 476cVjnoiK2Ghv1JfFiSBchuKwfFrU9aD4uDCAYe4Sab13hy5cYTKSd7CuF4LZJ76ZcDDt1WZZvpdZDuzbgPBPVs3yBBJ32 *After the payment: -Send us a mail to malignant@tuta.io in the correct following format: -Subject: [Your country name] Device/user name (Example: [USA] John Doe) -My unique ID: [Your unique ID]. -Transaction ID: [Transaction ID] and an attached screenshot of the payment. *Verification and confirmation: Once we verify and confirm your payment, we recognize your device and send you the decryption software. *Important notes: -We might give you a discount if you contact us within 24 hours. -Due to our busy emails, we may take up to 24 hours to respond. -All of our clients got their data back after the payment. -Failure to write in the correct form will get your mail ignored. -Any attempt to fake a transaction ID or screenshot will lead to a permanent loss of data.
Emails

malignant@tuta.io

Targets

    • Target

      90b709901d41e0c58923d0124beb345532d7f60a288a7432c8b2f0f0ff37ec67

    • Size

      957KB

    • MD5

      0ba90c8d8c655ee822f19820c7641b6c

    • SHA1

      94b09919d77c1760a003bcd3eee8745f79b5cd25

    • SHA256

      90b709901d41e0c58923d0124beb345532d7f60a288a7432c8b2f0f0ff37ec67

    • SHA512

      8c591016ea0edd78b00ad8cfcf6856e2f2902cbfd7208a3ca2367c0bcfbfdb89a473264d75f742706506e38e3edb0d42bfc627eb16191fe064464ce379c955f4

    • SSDEEP

      24576:Y5pOT/MvD8Un1s2nZkFXfRMwpb645ADkMU:nFYnepM4br5hM

    Score
    10/10
    chaosrevengeratevasionpersistenceransomwarespywarestealertrojan

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Detects command variations typically used by ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (181) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • RevengeRat Executable

      stealer

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Scripting

1
T1064

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks