Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 03:21
Behavioral task
behavioral1
Sample
8c6c723a4839d62780e8761b9513df5b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c6c723a4839d62780e8761b9513df5b.exe
Resource
win10v2004-20240226-en
General
-
Target
8c6c723a4839d62780e8761b9513df5b.exe
-
Size
189KB
-
MD5
8c6c723a4839d62780e8761b9513df5b
-
SHA1
3704056af3cc91c56fcca5577a60843a99732e7d
-
SHA256
279ef35a9f2748763ffa8107d1f6c3cf6d629979ea58403af6b2297f80d9eb72
-
SHA512
46360c4493ade57dc92112bc59681c0cc787fc192b132cbd8e62bdbbeeb23694c2a112ec2d6fad20e4630a92eaacfbf5444bc817e281fd7da7ff85b43737562d
-
SSDEEP
3072:lojUMpar9prL/txWwbPCXMoHTXdv14469I6HptMTmshOR9:hrr9pnzbPnoH36HptMphOR
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-0-0x0000000000330000-0x0000000000366000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos behavioral1/memory/2628-7-0x0000000001130000-0x0000000001166000-memory.dmp family_chaos -
Renames multiple (144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\@zarik [email protected] svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2628 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\s60bzen7w.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2628 svchost.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
8c6c723a4839d62780e8761b9513df5b.exesvchost.exepid process 1940 8c6c723a4839d62780e8761b9513df5b.exe 1940 8c6c723a4839d62780e8761b9513df5b.exe 2628 svchost.exe 2628 svchost.exe 2628 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8c6c723a4839d62780e8761b9513df5b.exesvchost.exedescription pid process Token: SeDebugPrivilege 1940 8c6c723a4839d62780e8761b9513df5b.exe Token: SeDebugPrivilege 2628 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8c6c723a4839d62780e8761b9513df5b.exesvchost.exedescription pid process target process PID 1940 wrote to memory of 2628 1940 8c6c723a4839d62780e8761b9513df5b.exe svchost.exe PID 1940 wrote to memory of 2628 1940 8c6c723a4839d62780e8761b9513df5b.exe svchost.exe PID 1940 wrote to memory of 2628 1940 8c6c723a4839d62780e8761b9513df5b.exe svchost.exe PID 2628 wrote to memory of 1960 2628 svchost.exe NOTEPAD.EXE PID 2628 wrote to memory of 1960 2628 svchost.exe NOTEPAD.EXE PID 2628 wrote to memory of 1960 2628 svchost.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c6c723a4839d62780e8761b9513df5b.exe"C:\Users\Admin\AppData\Local\Temp\8c6c723a4839d62780e8761b9513df5b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\@zarik [email protected]3⤵PID:1960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD58c6c723a4839d62780e8761b9513df5b
SHA13704056af3cc91c56fcca5577a60843a99732e7d
SHA256279ef35a9f2748763ffa8107d1f6c3cf6d629979ea58403af6b2297f80d9eb72
SHA51246360c4493ade57dc92112bc59681c0cc787fc192b132cbd8e62bdbbeeb23694c2a112ec2d6fad20e4630a92eaacfbf5444bc817e281fd7da7ff85b43737562d
-
C:\Users\Admin\Documents\@zarik [email protected]
Filesize192B
MD50f3192c97d96e862abdd464698ecbc9f
SHA1d6ad1e331a8c8403159e09a16cc1ddb4b24534fb
SHA256ae0665dbe51e1fc225ed189c55b77b33a17d2f707201abdc1fc3d587a424ba0e
SHA512847836318b900001b2da9db34a70d8139f19132ed5d69d78c1015f24d7c5b0d4eeedae3c74717a2e24f67ec96ed68dc143dfae55db9a6773602756edac2f0aa7