chaos | fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 15:20

Target

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe
Size

22KB
MD5

f38910f1c71e210f710b0d2aed182f55
SHA1

b1ec33aafba903812914d2b8d90c5ee0c6055107
SHA256

fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9
SHA512

0c8e3315c062f41134df5ef534923b1ade7d7eaf804f789ced322638113c1e9e4228131cbd43fc2713d419e3ba12c5d43e43fdad1e04684998282e1f58b3391b
SSDEEP

384:63Mg/bqo2etUq4/fHapyj8ZOjPJNr91CaTb5geM:Aqo2jNSpjZOjhNr9ZTbeeM

Score

10^/10

chaos ransomware

Chaos Ransomware 4 IoCs

resource	yara_rule
behavioral1/memory/1672-54-0x00000000008C0000-0x00000000008CC000-memory.dmp	family_chaos
behavioral1/files/0x0008000000005c51-56.dat	family_chaos
behavioral1/files/0x0008000000005c51-57.dat	family_chaos
behavioral1/memory/1520-58-0x00000000009A0000-0x00000000009AC000-memory.dmp	family_chaos

Executes dropped EXE 1 IoCs

pid	Process
1520	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	1520	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1672	fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe
1520	svchost.exe
1520	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe
Token: SeDebugPrivilege	1520	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1520	1672	fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe	27
PID 1672 wrote to memory of 1520	1672	fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe	27
PID 1672 wrote to memory of 1520	1672	fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9.exe	27
PID 1520 wrote to memory of 584	1520	svchost.exe	28
PID 1520 wrote to memory of 584	1520	svchost.exe	28
PID 1520 wrote to memory of 584	1520	svchost.exe	28

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
22KB

MD5
f38910f1c71e210f710b0d2aed182f55

SHA1
b1ec33aafba903812914d2b8d90c5ee0c6055107

SHA256
fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9

SHA512
0c8e3315c062f41134df5ef534923b1ade7d7eaf804f789ced322638113c1e9e4228131cbd43fc2713d419e3ba12c5d43e43fdad1e04684998282e1f58b3391b

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
22KB

MD5
f38910f1c71e210f710b0d2aed182f55

SHA1
b1ec33aafba903812914d2b8d90c5ee0c6055107

SHA256
fc68c5aab307cd0da6476a150562f9fdfbbd768b2b5fa3bf4b912219209c8cf9

SHA512
0c8e3315c062f41134df5ef534923b1ade7d7eaf804f789ced322638113c1e9e4228131cbd43fc2713d419e3ba12c5d43e43fdad1e04684998282e1f58b3391b

Download Submit
memory/1520-58-0x00000000009A0000-0x00000000009AC000-memory.dmp

Filesize
48KB

Download
memory/1672-54-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download