Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 08:46
Behavioral task
behavioral1
Sample
976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe
-
Size
181KB
-
MD5
a321ec0a5cb29407a0fa4d8e39586dee
-
SHA1
5a7fb5ee8a0cc0482fe6dce7a80696bd92ef0ca9
-
SHA256
976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6
-
SHA512
21e0f35818d7015a9b639929064fa89d83f712c472f23dcf0863742e9daf24120812c3adca4d8c46fc9d1201b20c80a9810e847b92722da8665ba33a4247517e
-
SSDEEP
3072:3NSvwL1IDAdAN+Uj7xRQIb+GinxNNB/hwlPaMhg/pxeJjYekLfncU1AlLncSRq5W:dSvwL6DAdAN+Uj7xRQIb2xY3hgxxedbF
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/2956-0-0x0000000000830000-0x0000000000864000-memory.dmp family_chaos behavioral2/files/0x000700000002320c-6.dat family_chaos -
Renames multiple (238) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oku.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1608 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqkt2b6r6.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3604 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1608 svchost.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe Token: SeDebugPrivilege 1608 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1608 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 91 PID 2956 wrote to memory of 1608 2956 976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe 91 PID 1608 wrote to memory of 3604 1608 svchost.exe 95 PID 1608 wrote to memory of 3604 1608 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe"C:\Users\Admin\AppData\Local\Temp\976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\oku.txt3⤵
- Opens file in notepad (likely ransom note)
PID:3604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD5a321ec0a5cb29407a0fa4d8e39586dee
SHA15a7fb5ee8a0cc0482fe6dce7a80696bd92ef0ca9
SHA256976cfac92a033f26ebde6eac45416c3db0fb88a963e9026fc67d115e9ba3b9e6
SHA51221e0f35818d7015a9b639929064fa89d83f712c472f23dcf0863742e9daf24120812c3adca4d8c46fc9d1201b20c80a9810e847b92722da8665ba33a4247517e
-
Filesize
275B
MD57c810579bbb67a19a1dae9977457ea36
SHA109253671d3dfd337bbce7e3f5ffe3b6b4e8a011a
SHA256e856648187d853d2a2f56198530d98d6ee84ca697aefec12b60351ff004a2a87
SHA51284ccd5ef54bb6618bd642cc11f9d14b1a3fbefa92b51de3adc9b43f7f9d90cb2fee9f12517f982960c531d8c9e424f574a0101550310647dd956a84d0e61a6b7