Analysis
-
max time kernel
1s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 23:31
Behavioral task
behavioral1
Sample
66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe
Resource
win10v2004-20231215-en
General
-
Target
66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe
-
Size
26KB
-
MD5
f7a4f6aa90509768c05391638001d8ec
-
SHA1
e9d7d58151543804c1cf1348c97b6a04b5ea3bb1
-
SHA256
8168216e4db26c5971cd1d7d2ab38a4b2e10f217a02053271ecf838c4a8f608a
-
SHA512
c3ef97b36b1dbfef0340bb573d2f1bdb8f009120be23cd297a425c605c63f2db39f2a3e50634f01054edb2931dd6a148a36ad67eaa89158668d8603bc11442a3
-
SSDEEP
384:qYenjLLAps4T5lBavzb/xlhKOVp91Qxb5hxDGt:5OElB6sc9GxbXxDy
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral1/memory/2500-0-0x00000000009B0000-0x00000000009BC000-memory.dmp family_chaos behavioral1/memory/3056-7-0x0000000000F60000-0x0000000000F6C000-memory.dmp family_chaos behavioral1/files/0x00070000000122c9-6.dat family_chaos -
Detects command variations typically used by ransomware 3 IoCs
resource yara_rule behavioral1/memory/2500-0-0x00000000009B0000-0x00000000009BC000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/3056-7-0x0000000000F60000-0x0000000000F6C000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x00070000000122c9-6.dat INDICATOR_SUSPICIOUS_GENRansomware -
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3056 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MAOUTFV0\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MO0EVTEO\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52FOIFWV\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3BH80GA\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\P78YEUVS\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2WD6IYSB\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OZ66ZEGB\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TQO7542V\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 808 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 3056 svchost.exe 3056 svchost.exe 3056 svchost.exe 3056 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe Token: SeDebugPrivilege 3056 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3056 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 22 PID 2500 wrote to memory of 3056 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 22 PID 2500 wrote to memory of 3056 2500 66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe 22
Processes
-
C:\Users\Admin\AppData\Local\Temp\66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe"C:\Users\Admin\AppData\Local\Temp\66f4c72aac78d1a3f50e2269496526a3739e3db15f518ad7843c4faecd5c6e0a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:808
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
964B
MD54217b8b83ce3c3f70029a056546f8fd0
SHA1487cdb5733d073a0427418888e8f7070fe782a03
SHA2567d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121
SHA5122a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
26KB
MD5f7a4f6aa90509768c05391638001d8ec
SHA1e9d7d58151543804c1cf1348c97b6a04b5ea3bb1
SHA2568168216e4db26c5971cd1d7d2ab38a4b2e10f217a02053271ecf838c4a8f608a
SHA512c3ef97b36b1dbfef0340bb573d2f1bdb8f009120be23cd297a425c605c63f2db39f2a3e50634f01054edb2931dd6a148a36ad67eaa89158668d8603bc11442a3