Analysis
-
max time kernel
43s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
21-09-2022 04:05
General
-
Target
HEUR-Trojan-Ransom.MSIL.Agent.gen-dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9.exe
-
Size
23KB
-
MD5
9080bc15edd3fa35a914e1b1d836783c
-
SHA1
34ed27203bb4ba0c8fe11448fbecbcaf2ace8cac
-
SHA256
dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9
-
SHA512
2d3bc85415c39dd7baa9a3b4c9914d43a103cdef6c679f2d13de1f4c78d577c42c041a76c34e288b763d229886190b4b52c0391907443d4699f601e78b711f07
-
SSDEEP
384:MOgHsqcYgBzImR5ZimJJ0r91CZnbJ/yw:MOgHsrhz3jZimH0r9gnbkw
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Agent.gen-dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Agent.gen-dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2024 -s 5643⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD59080bc15edd3fa35a914e1b1d836783c
SHA134ed27203bb4ba0c8fe11448fbecbcaf2ace8cac
SHA256dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9
SHA5122d3bc85415c39dd7baa9a3b4c9914d43a103cdef6c679f2d13de1f4c78d577c42c041a76c34e288b763d229886190b4b52c0391907443d4699f601e78b711f07
-
Filesize
23KB
MD59080bc15edd3fa35a914e1b1d836783c
SHA134ed27203bb4ba0c8fe11448fbecbcaf2ace8cac
SHA256dc38f8d0ae87bb8d97d4d02af5fa0c488fa03814d6fedafe4da08ae31794bbe9
SHA5122d3bc85415c39dd7baa9a3b4c9914d43a103cdef6c679f2d13de1f4c78d577c42c041a76c34e288b763d229886190b4b52c0391907443d4699f601e78b711f07
-
-
Filesize
48KB
-
-
Filesize
48KB