Overview

overview

10

Static

static

10

ransomware2.exe

windows7-x64

10

ransomware2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ransomware2.exe

  • Size

    27KB

  • Sample

    250215-ndbjeazlbl

  • MD5

    a0feb977ec93ffe5939ff03e81f7eda7

  • SHA1

    4b02f7dc42e715bf54492cbfe0f0f5dccec1729e

  • SHA256

    da00e98797600787431cb3c4c5d2771b2c3f235848247f7ab8c98453bb16b654

  • SHA512

    10732bc014891dee37f84d3fb91da1c804151379cd1df54a8472199ebb05fae6ab018d35142c91a932027ff29af9ae3b9659ca64a9448207800958a92210f3f6

  • SSDEEP

    384:8tWZPzzxAm1vW5Z2pzh71+kuzxBSKr0nlMUOy5o91WB1Fd82vEl:B7zxAm6Shgku26nUho94vP828l

Score
10/10
chaosadwaredefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\decrypt.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) - Write on our email with the payment proof and we will send you the tool - Email: [ur email] 2) - Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.) - Send the payment to [your btc address]

Targets

    • Target

      ransomware2.exe

    • Size

      27KB

    • MD5

      a0feb977ec93ffe5939ff03e81f7eda7

    • SHA1

      4b02f7dc42e715bf54492cbfe0f0f5dccec1729e

    • SHA256

      da00e98797600787431cb3c4c5d2771b2c3f235848247f7ab8c98453bb16b654

    • SHA512

      10732bc014891dee37f84d3fb91da1c804151379cd1df54a8472199ebb05fae6ab018d35142c91a932027ff29af9ae3b9659ca64a9448207800958a92210f3f6

    • SSDEEP

      384:8tWZPzzxAm1vW5Z2pzh71+kuzxBSKr0nlMUOy5o91WB1Fd82vEl:B7zxAm6Shgku26nUho94vP828l

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealeradwarediscoveryprivilege_escalation

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4
T1490

Tasks