Overview

overview

10

Static

static

10

what-exec.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    what-exec.exe

  • Size

    27KB

  • Sample

    240624-m4bresydkg

  • MD5

    3f6b3694acb8da30a32b251a26ad47f8

  • SHA1

    1f33dabf4d771ac15a18736f1654adcef766442d

  • SHA256

    21a8399765d18746070dc1cd3f749efd20688316253db7b9556c2c6bb5fcd026

  • SHA512

    47286456b5e14607a257ca7dd09269c75fcc72770ea0640b15f90a21bf6701363a7517056644e9fb0d0ba8ceb658e636b48ef39d8187f8ac223032942858948d

  • SSDEEP

    384:XLtWZPzzxAm1vp5ZRoDa2r7OUmgAYfdQPxgl/Oy5o91pWpF82v0:XC7zxAmpfyBrEgAYwEho9GX828

Score
10/10
chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Targets

    • Target

      what-exec.exe

    • Size

      27KB

    • MD5

      3f6b3694acb8da30a32b251a26ad47f8

    • SHA1

      1f33dabf4d771ac15a18736f1654adcef766442d

    • SHA256

      21a8399765d18746070dc1cd3f749efd20688316253db7b9556c2c6bb5fcd026

    • SHA512

      47286456b5e14607a257ca7dd09269c75fcc72770ea0640b15f90a21bf6701363a7517056644e9fb0d0ba8ceb658e636b48ef39d8187f8ac223032942858948d

    • SSDEEP

      384:XLtWZPzzxAm1vp5ZRoDa2r7OUmgAYfdQPxgl/Oy5o91pWpF82v0:XC7zxAmpfyBrEgAYwEho9GX828

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

1
T1112

Direct Volume Access

1
T1006

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

2
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4
T1490

Resource Development

Reconnaissance

Tasks