Overview

overview

10

Static

static

10

5b2e661eb9...c0.exe

windows7-x64

10

5b2e661eb9...c0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2022 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0.exe

  • Size

    689KB

  • MD5

    9188ac80b6c87150a513431bb27567bc

  • SHA1

    7abc0b85cefcec070ee47fb3a3c982df7b1c5e19

  • SHA256

    5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0

  • SHA512

    bdf8f930f25220b89757025f680b0ed3aa6909202922bf6c6ca7bd836bd03cd996b129cd5622936e5783ac57a26cb74a9b236d86d2915651b876f75020cf7e62

  • SSDEEP

    12288:56Z2+15Q3bpXI2grl9IU8dTYyrTnx0KJoxDxfJBEPdeu5IeYpj/e:5zgFsuSF5Ie

Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 3 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0.exe
    "C:\Users\Admin\AppData\Local\Temp\5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Roaming\Runtime Broker1.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker1.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3468
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:5020
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1448
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4268
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_instruction.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1940
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:32
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:4320
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1792

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0.exe.log
      Filesize

      1KB

      MD5

      baf55b95da4a601229647f25dad12878

      SHA1

      abc16954ebfd213733c4493fc1910164d825cac8

      SHA256

      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

      SHA512

      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Runtime Broker1.exe
      Filesize

      689KB

      MD5

      9188ac80b6c87150a513431bb27567bc

      SHA1

      7abc0b85cefcec070ee47fb3a3c982df7b1c5e19

      SHA256

      5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0

      SHA512

      bdf8f930f25220b89757025f680b0ed3aa6909202922bf6c6ca7bd836bd03cd996b129cd5622936e5783ac57a26cb74a9b236d86d2915651b876f75020cf7e62

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Runtime Broker1.exe
      Filesize

      689KB

      MD5

      9188ac80b6c87150a513431bb27567bc

      SHA1

      7abc0b85cefcec070ee47fb3a3c982df7b1c5e19

      SHA256

      5b2e661eb997b4b902ad009697549ce322a1e6d78d273dcb232b1b48f656e2c0

      SHA512

      bdf8f930f25220b89757025f680b0ed3aa6909202922bf6c6ca7bd836bd03cd996b129cd5622936e5783ac57a26cb74a9b236d86d2915651b876f75020cf7e62

      Download Submit

    • C:\Users\Admin\AppData\Roaming\read_instruction.txt
      Filesize

      746B

      MD5

      9ae2346e62e7975269fd664ed032928b

      SHA1

      cdf35bd0d86ab17d4dc0ef2700a74be4843f6965

      SHA256

      c1cdbbea66f7601e0390758bf2be53baf3e88159e6bc9b8dd8ecba555f636c9a

      SHA512

      a2f6b6c36719284ac7fae8f8d41b103a4e440f47b61006a707aef08d45b1ff77b4191d2d28a7422140d8fffe61f8211e12ccf746428ef358402da22d5f249221

      Download Submit

    • memory/544-140-0x0000000000000000-mapping.dmp

      Download

    • memory/1448-142-0x0000000000000000-mapping.dmp

      Download

    • memory/1940-147-0x0000000000000000-mapping.dmp

      Download

    • memory/3468-135-0x0000000000000000-mapping.dmp

      Download

    • memory/3468-139-0x00007FF99CF10000-0x00007FF99D9D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3468-146-0x00007FF99CF10000-0x00007FF99D9D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4268-144-0x0000000000000000-mapping.dmp

      Download

    • memory/4400-143-0x0000000000000000-mapping.dmp

      Download

    • memory/4688-138-0x00007FF99CF10000-0x00007FF99D9D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4688-132-0x0000000000370000-0x0000000000422000-memory.dmp

      Filesize

      712KB

      Download

    • memory/4688-134-0x00007FF99CF10000-0x00007FF99D9D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4688-133-0x00007FF99CF10000-0x00007FF99D9D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5020-141-0x0000000000000000-mapping.dmp

      Download