Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2023, 07:41
Behavioral task
behavioral1
Sample
8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe
Resource
win10v2004-20230703-en
General
-
Target
8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe
-
Size
342KB
-
MD5
28cfa829e7c09385aac5eae9439fb961
-
SHA1
71b0a00a387f50ab4727b6eb52ef52945837ebb0
-
SHA256
8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e
-
SHA512
51201855b63f1130bb08ac48af17a1c0281e86c707a78b14a30087404acb863a872f985d925a80bcec965316c18e493ad01306d5840428ff0b554fe9a8b836d8
-
SSDEEP
3072:iobbyor9dM9xCHGHQqEINH+pXzLjXR9DapqgPqtC26QjcwP0gjOkAZiLMRr+Zqql:vr9dMO/qEho/Pq/6QtI7szwup1jL0u
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 4 IoCs
resource yara_rule behavioral2/memory/4892-133-0x0000000000AC0000-0x0000000000B1C000-memory.dmp family_chaos behavioral2/files/0x000b0000000231b7-139.dat family_chaos behavioral2/files/0x000b0000000231b7-144.dat family_chaos behavioral2/files/0x000b0000000231b7-146.dat family_chaos -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1076 bcdedit.exe 4604 bcdedit.exe -
pid Process 3680 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4552 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4176143399-3250363947-192774652-1000\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\s25z0h98z.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4908 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1452 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4552 svchost.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe 4552 svchost.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe Token: SeDebugPrivilege 4552 svchost.exe Token: SeBackupPrivilege 4932 vssvc.exe Token: SeRestorePrivilege 4932 vssvc.exe Token: SeAuditPrivilege 4932 vssvc.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: 36 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: 36 1456 WMIC.exe Token: SeBackupPrivilege 2068 wbengine.exe Token: SeRestorePrivilege 2068 wbengine.exe Token: SeSecurityPrivilege 2068 wbengine.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1452 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4892 wrote to memory of 4552 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 92 PID 4892 wrote to memory of 4552 4892 8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe 92 PID 4552 wrote to memory of 1852 4552 svchost.exe 97 PID 4552 wrote to memory of 1852 4552 svchost.exe 97 PID 1852 wrote to memory of 4908 1852 cmd.exe 99 PID 1852 wrote to memory of 4908 1852 cmd.exe 99 PID 1852 wrote to memory of 1456 1852 cmd.exe 102 PID 1852 wrote to memory of 1456 1852 cmd.exe 102 PID 4552 wrote to memory of 5040 4552 svchost.exe 103 PID 4552 wrote to memory of 5040 4552 svchost.exe 103 PID 5040 wrote to memory of 1076 5040 cmd.exe 105 PID 5040 wrote to memory of 1076 5040 cmd.exe 105 PID 5040 wrote to memory of 4604 5040 cmd.exe 106 PID 5040 wrote to memory of 4604 5040 cmd.exe 106 PID 4552 wrote to memory of 2472 4552 svchost.exe 107 PID 4552 wrote to memory of 2472 4552 svchost.exe 107 PID 2472 wrote to memory of 3680 2472 cmd.exe 109 PID 2472 wrote to memory of 3680 2472 cmd.exe 109 PID 4552 wrote to memory of 1452 4552 svchost.exe 113 PID 4552 wrote to memory of 1452 4552 svchost.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe"C:\Users\Admin\AppData\Local\Temp\8d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4908
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1076
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:3680
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1452
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:548
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e1c4d147e1841231b2773b5d4c3b1618
SHA1f0469e7eadda1a916acc77e91abb0320b395a380
SHA256ccef53de379cfaacc903f0989dadb640946980715819e7c10cec261534f01af3
SHA512eb75815fd4e28612589071319df0405da054f131bc24064e249f2f524d1a413381d9313b5528608d078bf38e87b7fa3e9dea57edf147ce9b4425f550129d4910
-
Filesize
342KB
MD528cfa829e7c09385aac5eae9439fb961
SHA171b0a00a387f50ab4727b6eb52ef52945837ebb0
SHA2568d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e
SHA51251201855b63f1130bb08ac48af17a1c0281e86c707a78b14a30087404acb863a872f985d925a80bcec965316c18e493ad01306d5840428ff0b554fe9a8b836d8
-
Filesize
342KB
MD528cfa829e7c09385aac5eae9439fb961
SHA171b0a00a387f50ab4727b6eb52ef52945837ebb0
SHA2568d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e
SHA51251201855b63f1130bb08ac48af17a1c0281e86c707a78b14a30087404acb863a872f985d925a80bcec965316c18e493ad01306d5840428ff0b554fe9a8b836d8
-
Filesize
342KB
MD528cfa829e7c09385aac5eae9439fb961
SHA171b0a00a387f50ab4727b6eb52ef52945837ebb0
SHA2568d0f1d92b4fff838cf346d892d79c35e4be114c2f9f3ef15e23b34617c61515e
SHA51251201855b63f1130bb08ac48af17a1c0281e86c707a78b14a30087404acb863a872f985d925a80bcec965316c18e493ad01306d5840428ff0b554fe9a8b836d8
-
Filesize
1KB
MD5e1c4d147e1841231b2773b5d4c3b1618
SHA1f0469e7eadda1a916acc77e91abb0320b395a380
SHA256ccef53de379cfaacc903f0989dadb640946980715819e7c10cec261534f01af3
SHA512eb75815fd4e28612589071319df0405da054f131bc24064e249f2f524d1a413381d9313b5528608d078bf38e87b7fa3e9dea57edf147ce9b4425f550129d4910