Threat Signal Report

Fake Windows 11 Upgrade Assistant Program Leads to Destructive File Encrypter

description-logo Description

FortiGuard Labs has discovered a destructive file encrypter that poses as a Windows 11 Upgrade Assistant Program, taking advantage of the recent official release of Windows 11. The attacker appears to target admins and users who look for an easy and sure way for to upgrade the operating system (OS), which often leads to havoc. While the malware is based on Chaos ransomware, it only encrypts small files found on the compromised machine and acts as a wiper for files larger than 2,117,152 bytes that have specified file extensions. The malware does not steal information nor demand ransom payment for file decryption.


What Operating Systems are Affected?

Windows-based operating systems.


How Serious of an Issue is This?

High. An upgrade assistant for Windows 11 is a great lure considering the OS was officially released on October 5th, 2021, and the fact that admins and users often search for an easy and sure way to perform the OS upgrade task. Also, as the malware acts as both a file encrypter and a wiper and, as such, the victim may not be able to get some of their original files back.


How Widespread is this File Encrypter?

Unknown. FortiGuard Labs does not have information on how the malware was distributed. Because the malware poses as Windows 11 Upgrade Assistant program, admins and users must use tools only from reputable trusted sources.


What are the Technical Details of the Malware?

The malware calls itself Chaos11 ransomware. The name likely originates from the recently released Windows 11 and the fact the malware is based on Chaos ransomware.

Upon execution, the malware performs the following actions:

  • Encrypts files smaller than 2,117,152 bytes
  • Replaces with random bytes if a file is larger than 2,117,152 bytes that has one of the following file extensions:
    .txt,.jar,.dat,.contact,.settings,.doc,.docx,.xls,.xlsx,.ppt,.pptx,.odt,.jpg,.mka,.mhtml,.oqy,.png, .csv,.py,.sql,.mdb,.php,.asp,.aspx,.html,.htm,.xml,.psd,.pdf,.xla,.cub,.dae,.indd,.cs,.mp3,.mp4,.dwg, .zip,.rar,.mov,.rtf,.bmp,.mkv,.avi,.apk,.lnk,.dib,.dic,.dif,.divx,.iso,.7zip,.ace,.arj,.bz2,.cab,.gzip, .lzh,.tar,.jpeg,.xz,.mpeg,.torrent,.mpg,.core,.pdb,.ico,.pas,.db,.wmv,.swf,.cer,.bak,.backup,.accdb, .bay,.p7c,.exif,.vss,.raw,.m4a,.wma,.flv,.sie,.sum,.ibank,.wallet,.css,.js,.rb,.crt,.xlsm,.xlsb,.7z, .cpp,.java,.jpe,.ini,.blob,.wps,.docm,.wav,.3gp,.webm,.m4v,.amv,.m4p,.svg,.ods,.bk,.vdi,.vmdk,.onepkg, .accde,.jsp,.json,.gif,.log,.gz,.config,.vb,.m1v,.sln,.pst,.obj,.xlam,.djvu,.inc,.cvs,.dbf,.tbi,.wpd, .dot,.dotx,.xltx,.pptm,.potx,.potm,.pot,.xlw,.xps,.xsd,.xsf,.xsl,.kmz,.accdr,.stm,.accdt,.ppam,.pps, .ppsm,.1cd,.3ds,.3fr,.3g2,.accda,.accdc,.accdw,.adp,.ai,.ai3,.ai4,.ai5,.ai6,.ai7,.ai8,.arw,.ascx,.asm, .asmx,.avs,.bin,.cfm,.dbx,.dcm,.dcr,.pict,.rgbe,.dwt,.f4v,.exr,.kwm,.max,.mda,.mde,.mdf,.mdw,.mht,.mpv, .msg,.myi,.nef,.odc,.geo,.swift,.odm,.odp,.oft,.orf,.pfx,.p12,.pl,.pls,.safe,.tab,.vbs,.xlk,.xlm,.xlt, .xltm,.svgz,.slk,.tar.gz,.dmg,.ps,.psb,.tif,.rss,.key,.vob,.epsp,.dc3,.iff,.onepkg,.onetoc2,.opt,.p7b, .pam,.r3d
  • The malware does NOT steal any files from the compromised machine

The ransomware also deletes shadow copies from the compromised machine, which prevents the victim from being able to recover any files that had been encrypted from shadow copies.

The ransomware leaves a ransom note in dropped WTF.txt with the following message:

lol you thought that you were gonna get windows 11?

hell nah!

instead ur files got encryped by Chaos11 Ransomware! isnt that great?

because im a nice person, ill let you decrypt ur files for free.

just open one of the links below:

bit[.]ly/1X[Removed]

bit[.]ly/2X[Removed]

Chaos11 Ransomware made by: FuckWindows10


The first link goes to a music video of "Never gonna give you up" performed by Rick Astley.

The second link goes to a Chaos ransomware decrypter hosted on a public file hosting site. The decrypter is designed to decrypt files smaller than 3,117,152 bytes if privateKey.chaos containing the attacker's private key exists. This means that the victim is not able to recover files larger than 2,117,152 bytes which the malware filled with random bytes, effectively destroying them.


What is the Status of Coverage?

FortiGuard Labs has the following AV coverage in place for the Chaos ransomware variant

[SHA256: aae0f95647a8c676a910688638318274aa017c3370c6b2a1e0934b2795ffe20e] in place as:

MSIL/Filecoder.AGP!tr.ransom


For FortiEDR protections, all related IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.


Any Other Suggested Mitigation?

Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.

Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.