chaos | 55ff901e986a52d6e0700210a74a1ece69fdb3e0c5497f641ec6483a3c0f8751

General

Target

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
Size

329KB
MD5

eb9c6acdedd1e8a8bfd266403bfd520a
SHA1

c835f8e3fe7f35b7c61cffe842056bd573ce939b
SHA256

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41
SHA512

ff67f19d8d986917bbd4d6d00d0fae4b9907960108d4e00202d8e579d95e82b0c9386a07050c406157ba3f0a4d31d3f6aa89f09955ec5551607764679688fc32
SSDEEP

6144:+cVbL0hiIOM8+LDCvzCnQHw67feMv8KiPuTL94:+cVJIOd+vCvnJ8tPuF4

Score

10^/10

chaos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/812-54-0x0000000000810000-0x0000000000868000-memory.dmp	family_chaos
C:\Users\Admin\AppData\Roaming\svchost.exe	family_chaos
C:\Users\Admin\AppData\Roaming\svchost.exe	family_chaos
behavioral1/memory/1964-58-0x0000000000AB0000-0x0000000000B08000-memory.dmp	family_chaos

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

560 bcdedit.exe
1184 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1640 wbadmin.exe
Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1964 svchost.exe

pid	process
560	bcdedit.exe
1184	bcdedit.exe

pid	process
1640	wbadmin.exe

pid	process
1964	svchost.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\ExitReceive.png.5yk7	svchost.exe
File created	C:\Users\Admin\Pictures\ExportComplete.png.emc6	svchost.exe
File created	C:\Users\Admin\Pictures\FindLock.png.jcdg	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\HideExpand.tiff	svchost.exe
File created	C:\Users\Admin\Pictures\HideExpand.tiff.rs76	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\SyncSet.tiff	svchost.exe
File created	C:\Users\Admin\Pictures\SyncSet.tiff.qywk	svchost.exe
File created	C:\Users\Admin\Pictures\DisableWatch.raw.zth8	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1964 svchost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1964	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2012 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

212 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exesvchost.exe

pid process

812 ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
1964 svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exesvchost.exe

pid process

812 ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
1964 svchost.exe

pid	process
2012	vssadmin.exe

pid	process
212	NOTEPAD.EXE

pid	process
812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
1964	svchost.exe

pid	process
812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
1964	svchost.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exesvchost.exevssvc.exeWMIC.exewbengine.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
Token: SeDebugPrivilege	1964	svchost.exe
Token: SeBackupPrivilege	1004	vssvc.exe
Token: SeRestorePrivilege	1004	vssvc.exe
Token: SeAuditPrivilege	1004	vssvc.exe
Token: SeIncreaseQuotaPrivilege	668	WMIC.exe
Token: SeSecurityPrivilege	668	WMIC.exe
Token: SeTakeOwnershipPrivilege	668	WMIC.exe
Token: SeLoadDriverPrivilege	668	WMIC.exe
Token: SeSystemProfilePrivilege	668	WMIC.exe
Token: SeSystemtimePrivilege	668	WMIC.exe
Token: SeProfSingleProcessPrivilege	668	WMIC.exe
Token: SeIncBasePriorityPrivilege	668	WMIC.exe
Token: SeCreatePagefilePrivilege	668	WMIC.exe
Token: SeBackupPrivilege	668	WMIC.exe
Token: SeRestorePrivilege	668	WMIC.exe
Token: SeShutdownPrivilege	668	WMIC.exe
Token: SeDebugPrivilege	668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	668	WMIC.exe
Token: SeRemoteShutdownPrivilege	668	WMIC.exe
Token: SeUndockPrivilege	668	WMIC.exe
Token: SeManageVolumePrivilege	668	WMIC.exe
Token: 33	668	WMIC.exe
Token: 34	668	WMIC.exe
Token: 35	668	WMIC.exe
Token: SeIncreaseQuotaPrivilege	668	WMIC.exe
Token: SeSecurityPrivilege	668	WMIC.exe
Token: SeTakeOwnershipPrivilege	668	WMIC.exe
Token: SeLoadDriverPrivilege	668	WMIC.exe
Token: SeSystemProfilePrivilege	668	WMIC.exe
Token: SeSystemtimePrivilege	668	WMIC.exe
Token: SeProfSingleProcessPrivilege	668	WMIC.exe
Token: SeIncBasePriorityPrivilege	668	WMIC.exe
Token: SeCreatePagefilePrivilege	668	WMIC.exe
Token: SeBackupPrivilege	668	WMIC.exe
Token: SeRestorePrivilege	668	WMIC.exe
Token: SeShutdownPrivilege	668	WMIC.exe
Token: SeDebugPrivilege	668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	668	WMIC.exe
Token: SeRemoteShutdownPrivilege	668	WMIC.exe
Token: SeUndockPrivilege	668	WMIC.exe
Token: SeManageVolumePrivilege	668	WMIC.exe
Token: 33	668	WMIC.exe
Token: 34	668	WMIC.exe
Token: 35	668	WMIC.exe
Token: SeBackupPrivilege	1948	wbengine.exe
Token: SeRestorePrivilege	1948	wbengine.exe
Token: SeSecurityPrivilege	1948	wbengine.exe
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

212 NOTEPAD.EXE

pid	process
212	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exesvchost.execmd.execmd.execmd.exe

description	pid	process	target process
PID 812 wrote to memory of 1964	812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe	svchost.exe
PID 812 wrote to memory of 1964	812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe	svchost.exe
PID 812 wrote to memory of 1964	812	ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe	svchost.exe
PID 1964 wrote to memory of 2016	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 2016	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 2016	1964	svchost.exe	cmd.exe
PID 2016 wrote to memory of 2012	2016	cmd.exe	vssadmin.exe
PID 2016 wrote to memory of 2012	2016	cmd.exe	vssadmin.exe
PID 2016 wrote to memory of 2012	2016	cmd.exe	vssadmin.exe
PID 2016 wrote to memory of 668	2016	cmd.exe	WMIC.exe
PID 2016 wrote to memory of 668	2016	cmd.exe	WMIC.exe
PID 2016 wrote to memory of 668	2016	cmd.exe	WMIC.exe
PID 1964 wrote to memory of 432	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 432	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 432	1964	svchost.exe	cmd.exe
PID 432 wrote to memory of 560	432	cmd.exe	bcdedit.exe
PID 432 wrote to memory of 560	432	cmd.exe	bcdedit.exe
PID 432 wrote to memory of 560	432	cmd.exe	bcdedit.exe
PID 432 wrote to memory of 1184	432	cmd.exe	bcdedit.exe
PID 432 wrote to memory of 1184	432	cmd.exe	bcdedit.exe
PID 432 wrote to memory of 1184	432	cmd.exe	bcdedit.exe
PID 1964 wrote to memory of 468	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 468	1964	svchost.exe	cmd.exe
PID 1964 wrote to memory of 468	1964	svchost.exe	cmd.exe
PID 468 wrote to memory of 1640	468	cmd.exe	wbadmin.exe
PID 468 wrote to memory of 1640	468	cmd.exe	wbadmin.exe
PID 468 wrote to memory of 1640	468	cmd.exe	wbadmin.exe
PID 1964 wrote to memory of 212	1964	svchost.exe	NOTEPAD.EXE
PID 1964 wrote to memory of 212	1964	svchost.exe	NOTEPAD.EXE
PID 1964 wrote to memory of 212	1964	svchost.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe
"C:\Users\Admin\AppData\Local\Temp\ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2012

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
3⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:560

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1640

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\SkynetData.txt
3⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:908

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SkynetData.txt
Filesize
809B

MD5
ca069420f1d43dabba1630a2477891c7

SHA1
ec68214b8909fe0098b91a68aa01fb269c5a147a

SHA256
6763e8a512a14afefd3bba63ef0516dbb378436e2bc7d853eaeb7a6fdf5eb090

SHA512
2054aa509f5f839677d654529a76ef84e05c5b34a81037c65ce14fba527c01516643b4b97ada26869197f6c8d63270b24fe7392263bbd705f0ef95c9ca498336

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
329KB

MD5
eb9c6acdedd1e8a8bfd266403bfd520a

SHA1
c835f8e3fe7f35b7c61cffe842056bd573ce939b

SHA256
ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41

SHA512
ff67f19d8d986917bbd4d6d00d0fae4b9907960108d4e00202d8e579d95e82b0c9386a07050c406157ba3f0a4d31d3f6aa89f09955ec5551607764679688fc32

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
329KB

MD5
eb9c6acdedd1e8a8bfd266403bfd520a

SHA1
c835f8e3fe7f35b7c61cffe842056bd573ce939b

SHA256
ebc90f7e16ee51150267c78495d59e3a2a2b3880c7541ca3df0ff287b528fc41

SHA512
ff67f19d8d986917bbd4d6d00d0fae4b9907960108d4e00202d8e579d95e82b0c9386a07050c406157ba3f0a4d31d3f6aa89f09955ec5551607764679688fc32

Download Submit
memory/212-68-0x0000000000000000-mapping.dmp

Download
memory/432-62-0x0000000000000000-mapping.dmp

Download
memory/468-65-0x0000000000000000-mapping.dmp

Download
memory/560-63-0x0000000000000000-mapping.dmp

Download
memory/668-61-0x0000000000000000-mapping.dmp

Download
memory/812-54-0x0000000000810000-0x0000000000868000-memory.dmp

Filesize
352KB

Download
memory/1184-64-0x0000000000000000-mapping.dmp

Download
memory/1640-66-0x0000000000000000-mapping.dmp

Download
memory/1640-67-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/1964-58-0x0000000000AB0000-0x0000000000B08000-memory.dmp

Filesize
352KB

Download
memory/1964-55-0x0000000000000000-mapping.dmp

Download
memory/2012-60-0x0000000000000000-mapping.dmp

Download
memory/2016-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads