Overview

overview

10

Static

static

10

ransomeware.exe

windows7-x64

ransomeware.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2025 16:33

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    ransomeware.exe

  • Size

    72KB

  • MD5

    ae3d912081d1ed9e0e103290d2aa14a5

  • SHA1

    ca0b14020a16a418e9480d557c7f6f009210f3d7

  • SHA256

    4954b1413717c7e81ad5e75f68b9eba2f4bc5e30b2647b7725828170a0988efa

  • SHA512

    3e335153f2872733ad733d45c8a00d94a2b5c924e2f2b8149a84b3abdfbde1257dd21c9af4c4d8f6c49400fbffdf3319759fbf2bdfd805a4ef5725c031aba4f6

  • SSDEEP

    1536:4NoPN267q90a6XLX3ixLklrvmPzYxAfcwBgpGWshaqFcQRbHF49Z:f17q90a6TSdklyrRcyusNzNHo

Score
10/10
chaosdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail : [email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected] ) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 3 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 9 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomeware.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomeware.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1128
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3008
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3012
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1944
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:2868
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2728
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2380
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:2020
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
        PID:1692
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\WriteExport.xps.mkhh
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\WriteExport.xps.mkhh"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1724
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0
        1⤵
          PID:1084
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x1
          1⤵
            PID:2240

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Indicator Removal

          3
          T1070

          File Deletion

          3
          T1070.004

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Defacement

          1
          T1491

          Inhibit System Recovery

          4
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
            Filesize

            595B

            MD5

            4c78be4a1a58fd1a9c578ec2764088b0

            SHA1

            669a8573027e15fb74eeb931faaf969453694f83

            SHA256

            41af7386cf53609d4ced48c1f69e23fb9ac5c5973f97e4288d871eafb6b93f83

            SHA512

            3b66766f9e246ee9424e36888d409ba6b2676b917140060f4735ae1a32fa331559e6478f7d3285eaaf72b72da4925dba9410ed2831f8aa14cc9e177da6cb5b04

            Download Submit

          • C:\Users\Admin\AppData\Roaming\svchost.exe
            Filesize

            72KB

            MD5

            ae3d912081d1ed9e0e103290d2aa14a5

            SHA1

            ca0b14020a16a418e9480d557c7f6f009210f3d7

            SHA256

            4954b1413717c7e81ad5e75f68b9eba2f4bc5e30b2647b7725828170a0988efa

            SHA512

            3e335153f2872733ad733d45c8a00d94a2b5c924e2f2b8149a84b3abdfbde1257dd21c9af4c4d8f6c49400fbffdf3319759fbf2bdfd805a4ef5725c031aba4f6

            Download Submit

          • C:\Users\Admin\Desktop\PingStart.contact
            Filesize

            1B

            MD5

            d1457b72c3fb323a2671125aef3eab5d

            SHA1

            5bab61eb53176449e25c2c82f172b82cb13ffb9d

            SHA256

            8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

            SHA512

            ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

            Download Submit

          • C:\Users\Admin\Desktop\WriteExport.xps.mkhh
            Filesize

            330KB

            MD5

            4558548311b994f84533e5d03714e180

            SHA1

            41701156d5023190115244407f657b37424f8480

            SHA256

            c694118e914580f5097e46f18db48008b7b54b4d8ba413e9be836929b4c00c7e

            SHA512

            7ac43e16a1ef522ada6ce89811bc54f28f1587583a64a1d9a119ad2693a773ccf575324f36cf453ff459e8ae2a6a009adaacab37444c6bcc43e768a90fb3d02c

            Download Submit

          • memory/2132-5-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2132-11-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2132-1-0x0000000001010000-0x0000000001028000-memory.dmp

            Filesize

            96KB

            Download

          • memory/2132-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2996-9-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2996-10-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2996-8-0x0000000001360000-0x0000000001378000-memory.dmp

            Filesize

            96KB

            Download

          • memory/2996-973-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2996-978-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

            Filesize

            9.9MB

            Download