Analysis

  • max time kernel
    157s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 19:31

General

  • Target

    Version 2.8.exe

  • Size

    227KB

  • MD5

    2ab8e3e63a7c847855ad80770dc2fd59

  • SHA1

    dae76d78053f9699f4cb7ccae51df9d4b6202ac7

  • SHA256

    7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b

  • SHA512

    6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31

  • SSDEEP

    6144:yR9ixUkjCMkI3pwo9EkhtNK3OotdWV3vBLGC:oof+ewfkhsnWBvBj

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note
All of your files have been encrypted! Warning Attempting to remove the software will corrupt your hard drives meaning no further use even when wiped. We simply charge $25 which is far cheaper than buying a new drive. Your computer was infected with a ransomware software. Your files have been encrypted and you won't be able to decrypt them without purchasing $25 BTC. What can I do to get my files back? You will send payment of $25 BTC to gain access to your files again, once payment is made after 3 confirmations on the blockchain (15 mins) your files will be restored and the software will un-install itself from your computer. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment will increase soon to double, be cooperative and your files will be released. Payment information Amount: 0.000385636 BTC Bitcoin Address: bc1qc76qr24pxnms9f93mytfg4dn7ztuvmje7g43dr

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Drops file in System32 directory 11 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Version 2.8.exe
    "C:\Users\Admin\AppData\Local\Temp\Version 2.8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4664
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4016
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1020
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4048
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:224
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1500
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:2352
  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AssertRequest.jpg" /ForceBootstrapPaint3D
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1268
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
    1⤵
    • Drops file in System32 directory
    PID:1716
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2488
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4444
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3956
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:1988
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3288
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AssertRequest.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2672
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3456
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3780
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3644
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\read_it.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:1792

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

        Filesize

        202B

        MD5

        4566d1d70073cd75fe35acb78ff9d082

        SHA1

        f602ecc057a3c19aa07671b34b4fdd662aa033cc

        SHA256

        fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0

        SHA512

        b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8

      • C:\Users\Admin\AppData\Roaming\svchost.exe

        Filesize

        227KB

        MD5

        2ab8e3e63a7c847855ad80770dc2fd59

        SHA1

        dae76d78053f9699f4cb7ccae51df9d4b6202ac7

        SHA256

        7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b

        SHA512

        6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31

      • C:\Users\Admin\Desktop\read_it.txt

        Filesize

        1KB

        MD5

        ea03cbb2fdf2dc96252b579612602225

        SHA1

        ac9ceff3c368f7409b9a7201f62fa92eded4da51

        SHA256

        e4f0c335d1ffc3ed4a32ae4aee294c9652f67a765fbaaad1f90e0540d25ed565

        SHA512

        1388a3f740f84541f8a8c0298bfe8b71f03d86a71174f97a68edcb4bdca0f467d6823b94314fa54547451c3ec4f6bc2228d74bf7537acf7c2dfb9f5a2d398051

      • memory/1244-91-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

        Filesize

        10.8MB

      • memory/1244-35-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

        Filesize

        10.8MB

      • memory/1716-19-0x000002DFEB250000-0x000002DFEB251000-memory.dmp

        Filesize

        4KB

      • memory/1716-36-0x000002DFEB260000-0x000002DFEB261000-memory.dmp

        Filesize

        4KB

      • memory/1716-18-0x000002DFEB1C0000-0x000002DFEB1C1000-memory.dmp

        Filesize

        4KB

      • memory/1716-16-0x000002DFEB1C0000-0x000002DFEB1C1000-memory.dmp

        Filesize

        4KB

      • memory/1716-23-0x000002DFEB260000-0x000002DFEB261000-memory.dmp

        Filesize

        4KB

      • memory/1716-14-0x000002DFEB140000-0x000002DFEB141000-memory.dmp

        Filesize

        4KB

      • memory/1716-33-0x000002DFEB260000-0x000002DFEB261000-memory.dmp

        Filesize

        4KB

      • memory/1716-7-0x000002DFE2E60000-0x000002DFE2E70000-memory.dmp

        Filesize

        64KB

      • memory/1716-3-0x000002DFE25B0000-0x000002DFE25C0000-memory.dmp

        Filesize

        64KB

      • memory/3644-140-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-100-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

        Filesize

        2.0MB

      • memory/3644-145-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

        Filesize

        2.0MB

      • memory/3644-94-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-95-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-96-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-97-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-98-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-99-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

        Filesize

        2.0MB

      • memory/3644-146-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

        Filesize

        2.0MB

      • memory/3644-101-0x00007FFBB5280000-0x00007FFBB5290000-memory.dmp

        Filesize

        64KB

      • memory/3644-102-0x00007FFBB5280000-0x00007FFBB5290000-memory.dmp

        Filesize

        64KB

      • memory/3644-142-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-143-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-141-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

        Filesize

        64KB

      • memory/3644-144-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

        Filesize

        2.0MB

      • memory/3788-0-0x0000000000DF0000-0x0000000000E30000-memory.dmp

        Filesize

        256KB

      • memory/3788-2-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

        Filesize

        10.8MB

      • memory/3788-34-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

        Filesize

        10.8MB

      • memory/3788-1-0x0000000002E80000-0x0000000002ED0000-memory.dmp

        Filesize

        320KB