Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
29/03/2024, 03:38
General
- Target 37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
- Size 953KB
- Sample240329-d7ah4agg5x
- SHA256 37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\PLEASEREAD.txt
Ransom Note
- WELCOME, DODO has returned AGAIN. Your files have been encrypted and you won't be able to decrypt them. You can buy decryption software from us, this software will allow you to recover all of your data and remove the ransomware from your computer. The price of the software is $15. Payment can be made in Bitcoin How do I pay, where do I get Bitcoin? Purchasing cryptocurrency varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Payment information: send $15, to one of our addresses, then send us email with payment confirmation and you'll get the decryption software in email. Email Address : [email protected] BTC address: bc1qwel3y5ef4sgumcnm9njln3eupvxutymlv732gu We Promise ALl your files will be back as soon as u pay
Emails
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
- Detects command variations typically used by ransomware 2 IoCs
- Renames multiple (212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 34 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe"C:\Users\Admin\AppData\Local\Temp\37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\PLEASEREAD.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PLEASEREAD.txt
memory/1968-0-0x0000000000030000-0x0000000000124000-memory.dmp
memory/1968-1-0x000007FEF5940000-0x000007FEF632C000-memory.dmp
memory/1968-2-0x0000000000550000-0x00000000005D0000-memory.dmp
memory/1968-477-0x000007FEF5940000-0x000007FEF632C000-memory.dmp
memory/1968-478-0x0000000000550000-0x00000000005D0000-memory.dmp