Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 17:44
General
- Target c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe
- Size 49KB
- Sample261011-wbas4avtbs
- SHA256 c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Pictures\PENTA_README.txt
Ransom Note
- PENTA RANSOMWARE ATTENTION! Your documents, files, photos, and other important databases are all encrypted. Therefore, you no longer have access to your files and photos, and you cannot modify or execute them. If you want to recover your files, follow these commands and purchase a recovery key. 1. Contact email:[email protected] and prove that you infected by PENTA RANSOWMARE. 2. Go to the www.torproject.org and setup tor browser. 3. Please connect to the site: www.pentakey_35FH_0V1X_GRR3.onion and send 0.0035 bitcoin to the bitcoin wallet written on the site. If you don't have bitcoin, buy it with your credit card and send it. 4. If the purchase is complete, download recovery key and run the key. Your files will be restored if the program has run normally. 5. If you run the program and nothing happens, please run the program again. WARNING! Running a recovery key that is not purchased in the suggested way can seriously damage the file. If the recovery key does not work, please contact my email. If you do not purchase a recovery key within 24 hours, you will no longer be able to recover the file. You can't recover your files without using the recovery key, and if you do so yourself, the files can be damaged. Do not change the extension of encrypted files or change the data. An error may occur in the file decryption.
Emails
-
email:[email protected]
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 3 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe"C:\Users\Admin\AppData\Local\Temp\c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hi.exe"C:\Users\Admin\AppData\Roaming\hi.exe"2⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\PENTA_README.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
hi.exe
PENTA_README.txt
memory/920-45-0x0000000002640000-0x0000000002650000-memory.dmp
memory/920-47-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2360-0-0x0000000000FD0000-0x0000000000FE2000-memory.dmp