Analysis
-
max time kernel
101s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
13/12/2022, 05:54
Behavioral task
behavioral1
Sample
ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
General
-
Target
ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe
-
Size
1.1MB
-
MD5
e654d76dadfd3cefd9052a116afd0e00
-
SHA1
0774c3f2cdf2ef9760d1cacaeb9464e6f59cf745
-
SHA256
ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4
-
SHA512
5c85e2aea0db6a2fb9e1ad9960f5c42cb7db62d0089c635ae71e1d029dab83b96116770e054e8633ebeb1e0144120f937e4381b1fa1c04fe8a045aff38cfbf47
-
SSDEEP
12288:+kN2/snXKG+LtGEUSVH+9drewoSVKxXtP2qdhGAqU1HkYXUHtv7E3vyepAyvuUY0:+kN2/sjDzAPvhuv4Tgqea0nRhO
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral2/memory/4128-132-0x0000000000710000-0x000000000083C000-memory.dmp family_chaos behavioral2/files/0x000200000001e704-135.dat family_chaos behavioral2/files/0x000200000001e704-136.dat family_chaos -
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 652 bcdedit.exe 4320 bcdedit.exe -
pid Process 1124 wbadmin.exe -
Executes dropped EXE 1 IoCs
pid Process 2476 svchost.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AddSearch.raw => C:\Users\Admin\Pictures\AddSearch.raw.SEX3 svchost.exe File renamed C:\Users\Admin\Pictures\MountRevoke.tif => C:\Users\Admin\Pictures\MountRevoke.tif.SEX3 svchost.exe File renamed C:\Users\Admin\Pictures\SetOpen.raw => C:\Users\Admin\Pictures\SetOpen.raw.SEX3 svchost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!satana!.txt svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 33 IoCs
description ioc Process File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9gowq2ety.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3268 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings svchost.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2476 svchost.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe Token: SeDebugPrivilege 2476 svchost.exe Token: SeBackupPrivilege 2488 vssvc.exe Token: SeRestorePrivilege 2488 vssvc.exe Token: SeAuditPrivilege 2488 vssvc.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe Token: 36 2544 WMIC.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe Token: 36 2544 WMIC.exe Token: SeBackupPrivilege 364 wbengine.exe Token: SeRestorePrivilege 364 wbengine.exe Token: SeSecurityPrivilege 364 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4128 wrote to memory of 2476 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 84 PID 4128 wrote to memory of 2476 4128 ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe 84 PID 2476 wrote to memory of 2852 2476 svchost.exe 99 PID 2476 wrote to memory of 2852 2476 svchost.exe 99 PID 2852 wrote to memory of 3268 2852 cmd.exe 101 PID 2852 wrote to memory of 3268 2852 cmd.exe 101 PID 2852 wrote to memory of 2544 2852 cmd.exe 104 PID 2852 wrote to memory of 2544 2852 cmd.exe 104 PID 2476 wrote to memory of 2352 2476 svchost.exe 105 PID 2476 wrote to memory of 2352 2476 svchost.exe 105 PID 2352 wrote to memory of 652 2352 cmd.exe 107 PID 2352 wrote to memory of 652 2352 cmd.exe 107 PID 2352 wrote to memory of 4320 2352 cmd.exe 108 PID 2352 wrote to memory of 4320 2352 cmd.exe 108 PID 2476 wrote to memory of 2356 2476 svchost.exe 109 PID 2476 wrote to memory of 2356 2476 svchost.exe 109 PID 2356 wrote to memory of 1124 2356 cmd.exe 111 PID 2356 wrote to memory of 1124 2356 cmd.exe 111 PID 2476 wrote to memory of 3124 2476 svchost.exe 115 PID 2476 wrote to memory of 3124 2476 svchost.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe"C:\Users\Admin\AppData\Local\Temp\ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3268
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:652
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1124
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\!satana!.txt3⤵PID:3124
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1652
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:2960
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
485B
MD54a69a5b8e518e19e288f56e02e85ff06
SHA17e468e1a3239a9f943e2f4286afb7df61d6a8567
SHA256e9a25108a7253da4b02a86cdff843fc991566e53c05889bcfd0ddd006669de08
SHA51287afc6879173b6012fb4c456c255ccb0cbede4e4942d5c48b4e998cb58df8c69b00d6e626bb5d6df51a479135f7aee6b0cd1a2b13d67741cdcc413b0c3a155db
-
Filesize
1.1MB
MD5e654d76dadfd3cefd9052a116afd0e00
SHA10774c3f2cdf2ef9760d1cacaeb9464e6f59cf745
SHA256ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4
SHA5125c85e2aea0db6a2fb9e1ad9960f5c42cb7db62d0089c635ae71e1d029dab83b96116770e054e8633ebeb1e0144120f937e4381b1fa1c04fe8a045aff38cfbf47
-
Filesize
1.1MB
MD5e654d76dadfd3cefd9052a116afd0e00
SHA10774c3f2cdf2ef9760d1cacaeb9464e6f59cf745
SHA256ca452d795d8a7055e429e57205ff2b3a2083d28fe97dbb1ba591a3178df3a1a4
SHA5125c85e2aea0db6a2fb9e1ad9960f5c42cb7db62d0089c635ae71e1d029dab83b96116770e054e8633ebeb1e0144120f937e4381b1fa1c04fe8a045aff38cfbf47