Analysis
-
max time kernel
91s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21-09-2022 04:05
General
-
Target
HEUR-Trojan-Ransom.MSIL.Agent.gen-02db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1.exe
-
Size
49KB
-
MD5
5e685c7264d47dd21ebfa36a9437d142
-
SHA1
0984924bd1ff568a94e16240935c03a91e7a8ddf
-
SHA256
02db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1
-
SHA512
bd7b34592aecaa4184c191159acc7724a0f393efe98673a36596ff7665e9415b49238293f187a36564287e8cfdbb7478fc1759f81a3b5d9b52c3f7e47b5cf294
-
SSDEEP
768:bqo2mpeWxyfr9+d4mZryx7L2ksQ1QCEez:2o2Ixyfr9+dsx32XKZz
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Agent.gen-02db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Agent.gen-02db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\PENTA.exe"C:\Users\Admin\AppData\Roaming\PENTA.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\PENTA_README.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD55e685c7264d47dd21ebfa36a9437d142
SHA10984924bd1ff568a94e16240935c03a91e7a8ddf
SHA25602db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1
SHA512bd7b34592aecaa4184c191159acc7724a0f393efe98673a36596ff7665e9415b49238293f187a36564287e8cfdbb7478fc1759f81a3b5d9b52c3f7e47b5cf294
-
Filesize
49KB
MD55e685c7264d47dd21ebfa36a9437d142
SHA10984924bd1ff568a94e16240935c03a91e7a8ddf
SHA25602db375475c56ba5c97f602e4c2eea8cac66e08d9a31ec7efabe35210b0d0aa1
SHA512bd7b34592aecaa4184c191159acc7724a0f393efe98673a36596ff7665e9415b49238293f187a36564287e8cfdbb7478fc1759f81a3b5d9b52c3f7e47b5cf294
-
Filesize
929B
MD52eb269ce83ecd8571f29b9991337387a
SHA1549c8a78cc3b44ef0f5f4b15220b3672b30632cf
SHA256efa8c2cf45e480b9ea08f68964d49e40b33cefdb9fac2a4e73a9677de1f0725e
SHA512ccd1025903a64e8f3e76d9c15e168d66943bc55d275ea68cef7f855ed12cf68152c6400755278cf3624e8cba0a5c721d97b9394edfd0aa146aec768c842ddaab
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB