Analysis
-
max time kernel
4264966s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-01-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
AZ(DANGEROUS).exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
AZ(DANGEROUS).exe
Resource
win10v2004-en-20220113
General
-
Target
AZ(DANGEROUS).exe
-
Size
549KB
-
MD5
b3858953d8c79049f6a46b254e6eab6b
-
SHA1
e4407979997b5e1000abaac3a75545e82e8a15b9
-
SHA256
6a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
-
SHA512
6c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 6 IoCs
resource yara_rule behavioral2/memory/3372-133-0x0000000000A80000-0x0000000000B0E000-memory.dmp family_chaos behavioral2/memory/3372-134-0x0000000000A80000-0x0000000000B0E000-memory.dmp family_chaos behavioral2/files/0x000300000001e738-136.dat family_chaos behavioral2/files/0x000300000001e738-137.dat family_chaos behavioral2/memory/1592-138-0x0000000000500000-0x000000000058E000-memory.dmp family_chaos behavioral2/memory/1592-139-0x0000000000500000-0x000000000058E000-memory.dmp family_chaos -
Executes dropped EXE 1 IoCs
pid Process 1592 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation AZ(DANGEROUS).exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.url explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 3372 AZ(DANGEROUS).exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3372 AZ(DANGEROUS).exe Token: SeShutdownPrivilege 1800 MusNotification.exe Token: SeCreatePagefilePrivilege 1800 MusNotification.exe Token: SeDebugPrivilege 1592 explorer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1592 3372 AZ(DANGEROUS).exe 56 PID 3372 wrote to memory of 1592 3372 AZ(DANGEROUS).exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\AZ(DANGEROUS).exe"C:\Users\Admin\AppData\Local\Temp\AZ(DANGEROUS).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1800