Analysis
-
max time kernel
4264966s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-01-2022 15:54
General
-
Target
AZ(DANGEROUS).exe
-
Size
549KB
-
MD5
b3858953d8c79049f6a46b254e6eab6b
-
SHA1
e4407979997b5e1000abaac3a75545e82e8a15b9
-
SHA256
6a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
-
SHA512
6c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AZ(DANGEROUS).exe"C:\Users\Admin\AppData\Local\Temp\AZ(DANGEROUS).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
b3858953d8c79049f6a46b254e6eab6b
SHA1e4407979997b5e1000abaac3a75545e82e8a15b9
SHA2566a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
SHA5126c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
-
MD5
b3858953d8c79049f6a46b254e6eab6b
SHA1e4407979997b5e1000abaac3a75545e82e8a15b9
SHA2566a3e60f725d30ab2660c6c9e6928bafe273583e3e501097934e873593a13aee6
SHA5126c37402f8b3d76320b5b1db246a3376919ac77e48f1f66d666c5c904519e644daf992e7917632e072cd4b7df91cc42fc0a9cdae84892d9125dbbcbaea6f1169f
-
Filesize
568KB
-
-
Filesize
568KB
-
Filesize
568KB
-
Filesize
568KB