Resubmissions
30-07-2023 23:06
230730-23w4asbf54 1030-07-2023 20:04
230730-ytlz7abc77 1030-07-2023 20:00
230730-yqxyaabc67 10Analysis
-
max time kernel
54s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
30-07-2023 23:06
General
-
Target
database.tar
-
Size
69.7MB
-
MD5
ea91bffa35a90c625af0fa48b10b7efe
-
SHA1
d6d3818f44d82c1e3e2933aa13e87c592d4e7670
-
SHA256
35f81c70e570891c59d7fdcef17d22d6f6df913a0e30dcb1dd6fc42a38b48475
-
SHA512
a9c53f487f3552fe7749ba0a9c79cf6a8b3c06794f7862b696c6e04f164cb0630791ed772120267e5c9c0276cc0efc4b269fa4629575df544bcd4f745954a74c
-
SSDEEP
1572864:UvrzuXaQLrouRp2OztQNmsoF5bfq1oDRl6toF88B99ea7/KOAhi:QrzELrDhQ0soF5bm6d8A5n
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 15 IoCs
-
Suspicious use of SendNotifyMessage 14 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\database.tar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap22064:74:7zEvent214311⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Chaos Ransomware BuilderV4.exe"C:\Users\Admin\Desktop\Chaos Ransomware BuilderV4.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\lol.exe"C:\Users\Admin\Desktop\lol.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\lol.exeC:\Users\Admin\Desktop\lol.exe msg2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\lol.exeC:\Users\Admin\Desktop\lol.exe lol2⤵
-
-
C:\Users\Admin\Desktop\lol.exeC:\Users\Admin\Desktop\lol.exe lol2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x41c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\RealBomb.exe"C:\Users\Admin\Desktop\RealBomb.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2EEB.tmp\2EEC.tmp\2EED.bat C:\Users\Admin\Desktop\RealBomb.exe"2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55f614e851a366cef3bb3ff1f1dad288c
SHA1d377d0053be0a7f386888c311d82f019489ca1c1
SHA256d75111e4c4d93f8469acf4adfa5d0ae314c127f62f740450f01927de24e45642
SHA5124a65c3c09b1ab5ddddcc97f079cdb5f60de3828ff73c9cda5895f484e5255e2c2b51d26e6b5b10ae6c73a4a77f7d94091beb88d278d9f6b7c21dceece9ffa397
-
Filesize
550KB
MD58b855e56e41a6e10d28522a20c1e0341
SHA117ea75272cfe3749c6727388fd444d2c970f9d01
SHA256f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
SHA512eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
-
Filesize
550KB
MD58b855e56e41a6e10d28522a20c1e0341
SHA117ea75272cfe3749c6727388fd444d2c970f9d01
SHA256f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
SHA512eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
-
Filesize
5.7MB
MD56dc0846ba8e5b8be7566221ed0c5f1ce
SHA171c31ead12e6fd46238544cf971bea8482a78f54
SHA256a51117b4e0388c3be68689917c55563b548f1fdfef9ce212187fdd20faab7360
SHA512801b568c6da6ce750be6ed6501afd63e95e824db7da577da7221fa42e6e33702f7a8723657be83a4516d463fe6ded3282dfa0473d137c28cb9b57ee6e8b3ad39
-
Filesize
5.7MB
MD56dc0846ba8e5b8be7566221ed0c5f1ce
SHA171c31ead12e6fd46238544cf971bea8482a78f54
SHA256a51117b4e0388c3be68689917c55563b548f1fdfef9ce212187fdd20faab7360
SHA512801b568c6da6ce750be6ed6501afd63e95e824db7da577da7221fa42e6e33702f7a8723657be83a4516d463fe6ded3282dfa0473d137c28cb9b57ee6e8b3ad39
-
Filesize
1.0MB
MD5e142b63cce234916e2256eeeeebeb49c
SHA17e572d2909be93852ac7a18ff5a81f57f2029dd7
SHA2560db8bf2d0c58b383c9f90274aee85d4c4937affa0ddd2d8f4f0fcb8f060b7e4e
SHA512a31abd812f27667916ee4a9f7332d204e9e42696a657de450be501940d43e0b822143d18f996729814a3e76910c60515f1aab7cf99d51e60f9db23dc69853f53
-
Filesize
1.0MB
MD5e142b63cce234916e2256eeeeebeb49c
SHA17e572d2909be93852ac7a18ff5a81f57f2029dd7
SHA2560db8bf2d0c58b383c9f90274aee85d4c4937affa0ddd2d8f4f0fcb8f060b7e4e
SHA512a31abd812f27667916ee4a9f7332d204e9e42696a657de450be501940d43e0b822143d18f996729814a3e76910c60515f1aab7cf99d51e60f9db23dc69853f53
-
Filesize
1.0MB
MD5e142b63cce234916e2256eeeeebeb49c
SHA17e572d2909be93852ac7a18ff5a81f57f2029dd7
SHA2560db8bf2d0c58b383c9f90274aee85d4c4937affa0ddd2d8f4f0fcb8f060b7e4e
SHA512a31abd812f27667916ee4a9f7332d204e9e42696a657de450be501940d43e0b822143d18f996729814a3e76910c60515f1aab7cf99d51e60f9db23dc69853f53
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
568KB