Overview
overview
10Static
static
10Ransomware.Thanos.zip
windows7-x64
1Ransomware.Thanos.zip
windows10-2004-x64
58bfb9fa88...1f.exe
windows7-x64
58bfb9fa88...1f.exe
windows10-2004-x64
105d40615701...3d.exe
windows7-x64
95d40615701...3d.exe
windows10-2004-x64
9ae66e009e1...75.exe
windows7-x64
ae66e009e1...75.exe
windows10-2004-x64
c460fc0d4f...50.exe
windows7-x64
c460fc0d4f...50.exe
windows10-2004-x64
Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
14-12-2023 22:59
Behavioral task
behavioral1
Sample
Ransomware.Thanos.zip
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
Ransomware.Thanos.zip
Resource
win10v2004-20231201-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral6
Sample
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75.exe
Resource
win7-20231130-en
windows7-x64
Behavioral task
behavioral8
Sample
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Resource
win10v2004-20231201-en
windows10-2004-x64
General
-
Target
Ransomware.Thanos.zip
-
Size
145KB
-
MD5
00184463f3b071369d60353c692be6f0
-
SHA1
d3c1e90f39da2997ef4888b54d706b1a1fde642a
-
SHA256
cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
-
SHA512
baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
-
SSDEEP
3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2584 chrome.exe 2584 chrome.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe Token: SeShutdownPrivilege 2584 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe 2584 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2312 2584 chrome.exe 31 PID 2584 wrote to memory of 2312 2584 chrome.exe 31 PID 2584 wrote to memory of 2312 2584 chrome.exe 31 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 3016 2584 chrome.exe 33 PID 2584 wrote to memory of 1476 2584 chrome.exe 34 PID 2584 wrote to memory of 1476 2584 chrome.exe 34 PID 2584 wrote to memory of 1476 2584 chrome.exe 34 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35 PID 2584 wrote to memory of 1524 2584 chrome.exe 35
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware.Thanos.zip1⤵PID:1872
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6aa9758,0x7fef6aa9768,0x7fef6aa97782⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:22⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:12⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:22⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2984 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:12⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3720 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3716 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:82⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3620 --field-trial-handle=1360,i,16030343450799500544,1932497648026607387,131072 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5fdda8256dc6cd71bbc584e95703e03d7
SHA105e3cd20c8eae7a386552586d8e2f527b66eb831
SHA2564c38dd791e230ffc0585608d8b8a64f2557394f28c72c6a41784fffe71458d6a
SHA5123dcf4681f5fa3308adaaf47cc38f96c2411eadf7327d4bb94c0b12cdfe8c91b6017d66820fc2bf3995f0ac346878500976363c3fc1295f404353816eff046da8
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
361B
MD5caa71e3630a1a6e376895e49fbde6f2a
SHA1c5a4632f68b0adaafd2c8554427798a8a70f8b77
SHA256341303e8717d9c1722ed86852c36dcbce04a12594b68b3c8738d4eb99bd48f32
SHA5126f30d665ad8001bbf635838ae4ffa057613ed3eaebb1cc9002adc74088d07c9433b3136e72d89093bad9c9fda0e54cb085f8c390d911c9e81cdd016ef6dcbdcf
-
Filesize
4KB
MD5abdae5142331602464cbe6103970be01
SHA192b413f96f513c6c9a4f49c7f40015d9de5a90f3
SHA256c0f809ca0b0f92194b6dbe51e1adae11e9cae8f5d3f839d977bb8e73eba15a08
SHA512d7d43c162bf34d856f16bc7f5ada8a47d02b4463cdd556f71be06b283747b5ad39138c750bfb57c3f1d0f7077c1757fa372a4e198798a60d05e1e045ce49b843
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
219KB
MD54b6484bc963a417c2cd6e3554aa182ec
SHA1d4e9f3e73f030025cfda10cb008d3ac923bf1edb
SHA256aab4b8ea323ffd5a93c565e27bb6a484c2282bf82a113e7a5be3dd4b3af78120
SHA5123d432bc435d7126dfd85a70fa7fca3b71a0a509bd6e6f276186582e1cc92a2900541d7032caea72bbcb738c2a49c8887957f49b20409c7f15dd801fdcc640e81