Analysis
-
max time kernel
95s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 17:15
Behavioral task
behavioral1
Sample
speakerwoman.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
speakerwoman.exe
Resource
win10v2004-20240226-en
General
-
Target
speakerwoman.exe
-
Size
169KB
-
MD5
09cd7152db837a6b1ec65dd6bf99cce9
-
SHA1
1591282093b637060d1f542da93ccdcf660a6b0d
-
SHA256
d048804223a758e7a90b9a65bc452c8eb05d6fc8f5b33618f8783e6c53af2730
-
SHA512
293fc7f42d7b4fc3ba9db1925d2d3f7d9e9e99d382fb30f46e391f9b56125142321ac121f96e2303a6f23fd64b8c4d8de5a75a9e369e6f46ea23fc2fa3a8598a
-
SSDEEP
3072:to0YhjV4qr9UL9zOkrXf8jhObiPoT0rXCHq/mP22HaorLhopvmAosjLAkMliem1m:E5r9ULJOkrX0EvT4CHq/E2t2euVspGm
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2700-0-0x00000000001C0000-0x00000000001F0000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos behavioral1/memory/2080-7-0x0000000000870000-0x00000000008A0000-memory.dmp family_chaos behavioral1/memory/2080-11-0x000000001AE60000-0x000000001AEE0000-memory.dmp family_chaos behavioral1/memory/576-453-0x0000000001160000-0x0000000001190000-memory.dmp family_chaos -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 2080 svchost.exe 2316 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bdzgr4819.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 32 IoCs
Processes:
csrss.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
Processes:
winlogon.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1892 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2080 svchost.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
speakerwoman.exesvchost.exespeakerwoman.exesvchost.exetaskmgr.exepid process 2700 speakerwoman.exe 2700 speakerwoman.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 576 speakerwoman.exe 576 speakerwoman.exe 576 speakerwoman.exe 2316 svchost.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 964 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
speakerwoman.exesvchost.exespeakerwoman.exesvchost.exetaskmgr.exeLogonUI.exewinlogon.exedescription pid process Token: SeDebugPrivilege 2700 speakerwoman.exe Token: SeDebugPrivilege 2080 svchost.exe Token: SeDebugPrivilege 576 speakerwoman.exe Token: SeDebugPrivilege 2316 svchost.exe Token: SeDebugPrivilege 964 taskmgr.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeSecurityPrivilege 1948 winlogon.exe Token: SeBackupPrivilege 1948 winlogon.exe Token: SeSecurityPrivilege 1948 winlogon.exe Token: SeTcbPrivilege 1948 winlogon.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeSecurityPrivilege 1948 winlogon.exe Token: SeBackupPrivilege 1948 winlogon.exe Token: SeSecurityPrivilege 1948 winlogon.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeShutdownPrivilege 2780 LogonUI.exe Token: SeShutdownPrivilege 2780 LogonUI.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
NOTEPAD.EXEtaskmgr.exepid process 1892 NOTEPAD.EXE 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe -
Suspicious use of SendNotifyMessage 25 IoCs
Processes:
taskmgr.exepid process 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe 964 taskmgr.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
speakerwoman.exesvchost.exespeakerwoman.execsrss.exewinlogon.exedescription pid process target process PID 2700 wrote to memory of 2080 2700 speakerwoman.exe svchost.exe PID 2700 wrote to memory of 2080 2700 speakerwoman.exe svchost.exe PID 2700 wrote to memory of 2080 2700 speakerwoman.exe svchost.exe PID 2080 wrote to memory of 1892 2080 svchost.exe NOTEPAD.EXE PID 2080 wrote to memory of 1892 2080 svchost.exe NOTEPAD.EXE PID 2080 wrote to memory of 1892 2080 svchost.exe NOTEPAD.EXE PID 576 wrote to memory of 2316 576 speakerwoman.exe svchost.exe PID 576 wrote to memory of 2316 576 speakerwoman.exe svchost.exe PID 576 wrote to memory of 2316 576 speakerwoman.exe svchost.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1948 wrote to memory of 2780 1948 winlogon.exe LogonUI.exe PID 1948 wrote to memory of 2780 1948 winlogon.exe LogonUI.exe PID 1948 wrote to memory of 2780 1948 winlogon.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe PID 1272 wrote to memory of 2780 1272 csrss.exe LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\speakerwoman.exe"C:\Users\Admin\AppData\Local\Temp\speakerwoman.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1892
-
C:\Users\Admin\AppData\Local\Temp\ose00000.exe"C:\Users\Admin\AppData\Local\Temp\ose00000.exe"1⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\speakerwoman.exe"C:\Users\Admin\AppData\Local\Temp\speakerwoman.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:964
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1744
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1272
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD509cd7152db837a6b1ec65dd6bf99cce9
SHA11591282093b637060d1f542da93ccdcf660a6b0d
SHA256d048804223a758e7a90b9a65bc452c8eb05d6fc8f5b33618f8783e6c53af2730
SHA512293fc7f42d7b4fc3ba9db1925d2d3f7d9e9e99d382fb30f46e391f9b56125142321ac121f96e2303a6f23fd64b8c4d8de5a75a9e369e6f46ea23fc2fa3a8598a
-
Filesize
964B
MD54217b8b83ce3c3f70029a056546f8fd0
SHA1487cdb5733d073a0427418888e8f7070fe782a03
SHA2567d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121
SHA5122a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740