Analysis

  • max time kernel
    209s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 18:56

General

  • Target

    exec.exe

  • Size

    223KB

  • MD5

    a32b23db12286223af4786eccf8f66d7

  • SHA1

    fe19f59183dcf801749457140b4b3aeeb3e82598

  • SHA256

    5f161fe20eafa6de2ad791276d14bd1c28013a1dd7b83b8b20016ea3065eacbf

  • SHA512

    0395949d424e0898d25efa5713952c2e2df155f743c5d158003268256c4c541bd83c10bf2653e4fa31ed52bb1a044e4e19e9464f7d972313a5a8e2f1b4856aa0

  • SSDEEP

    6144:m4Er9iAYFCtntIVprUPvEefILCrSK3FK+x:m4GYFCtntIVqPvCLCrSK1K+x

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note
All of your files have been encrypted! Warning Attempting to remove the software will corrupt your hard drives meaning no further use even when wiped. We simply charge $25 which is far cheaper than buying a new drive. Your computer was infected with a ransomware software. Your files have been encrypted and you won't be able to decrypt them without purchasing $25 BTC. What can I do to get my files back? You will send payment of $25 BTC to gain access to your files again, once payment is made after 3 confirmations on the blockchain (15 mins) your files will be restored and the software will un-install itself from your computer. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment will increase soon to double, be cooperative and your files will be released. Payment information Amount: 0.000385636 BTC Bitcoin Address: bc1qc76qr24pxnms9f93mytfg4dn7ztuvmje7g43dr

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exec.exe
    "C:\Users\Admin\AppData\Local\Temp\exec.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:2804
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1992
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SearchClose.ram"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2364
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:572
    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
        "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
        2⤵
          PID:4904
        • C:\Windows\SysWOW64\unregmp2.exe
          "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3352
          • C:\Windows\system32\unregmp2.exe
            "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
            3⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\FindStop.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:5036
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RedoReceive.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:2120

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

        Filesize

        640KB

        MD5

        1abac8fb3e93d6cde82ed884f459e271

        SHA1

        f474c4d2e883698ee30730f6da3b46e577c7590d

        SHA256

        d031fef6cd43f7df706246be61945c202649666f687ef240035e7302686e815b

        SHA512

        4bdcaef5e5fd97270ee183a49e6164cbf77d9a08613aeb6d7139ab4a887000f6857115377428a36fa3f61dccd3c57b9f4ae0e726c144868b0b514ac3af172839

      • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

        Filesize

        9KB

        MD5

        7050d5ae8acfbe560fa11073fef8185d

        SHA1

        5bc38e77ff06785fe0aec5a345c4ccd15752560e

        SHA256

        cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

        SHA512

        a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

      • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

        Filesize

        1KB

        MD5

        5d635caaf8327b3b2f43a1958a42456f

        SHA1

        b9de60d57017fa8bfcdbdcafa4fe060b9561e349

        SHA256

        4f89bcc2f6887083fe2f522cd77e0ed2a914e5b38aab047c31c90930106cdea5

        SHA512

        b0264fc63bee031d2c2dd3fd248bb05dda1b54cf07e72a5c648d8c8d01407eac19f4abe0f9facb303148fc8e1ddc62fe37783eca9e82d48da98caaa16a5ddc6a

      • C:\Users\Admin\AppData\Roaming\svchost.exe

        Filesize

        223KB

        MD5

        a32b23db12286223af4786eccf8f66d7

        SHA1

        fe19f59183dcf801749457140b4b3aeeb3e82598

        SHA256

        5f161fe20eafa6de2ad791276d14bd1c28013a1dd7b83b8b20016ea3065eacbf

        SHA512

        0395949d424e0898d25efa5713952c2e2df155f743c5d158003268256c4c541bd83c10bf2653e4fa31ed52bb1a044e4e19e9464f7d972313a5a8e2f1b4856aa0

      • C:\Users\Admin\Desktop\read_it.txt

        Filesize

        1KB

        MD5

        ea03cbb2fdf2dc96252b579612602225

        SHA1

        ac9ceff3c368f7409b9a7201f62fa92eded4da51

        SHA256

        e4f0c335d1ffc3ed4a32ae4aee294c9652f67a765fbaaad1f90e0540d25ed565

        SHA512

        1388a3f740f84541f8a8c0298bfe8b71f03d86a71174f97a68edcb4bdca0f467d6823b94314fa54547451c3ec4f6bc2228d74bf7537acf7c2dfb9f5a2d398051

      • memory/2364-95-0x00007FF96A7C0000-0x00007FF96A816000-memory.dmp

        Filesize

        344KB

      • memory/2364-70-0x00007FF7E9E50000-0x00007FF7E9F48000-memory.dmp

        Filesize

        992KB

      • memory/2364-98-0x00007FF9695E0000-0x00007FF9695F7000-memory.dmp

        Filesize

        92KB

      • memory/2364-77-0x00007FF980610000-0x00007FF980621000-memory.dmp

        Filesize

        68KB

      • memory/2364-78-0x00007FF9800F0000-0x00007FF98010D000-memory.dmp

        Filesize

        116KB

      • memory/2364-79-0x00007FF96E800000-0x00007FF96E811000-memory.dmp

        Filesize

        68KB

      • memory/2364-76-0x00007FF9812B0000-0x00007FF9812C7000-memory.dmp

        Filesize

        92KB

      • memory/2364-75-0x00007FF984100000-0x00007FF984111000-memory.dmp

        Filesize

        68KB

      • memory/2364-80-0x00007FF967460000-0x00007FF967660000-memory.dmp

        Filesize

        2.0MB

      • memory/2364-81-0x00007FF96D980000-0x00007FF96D9BF000-memory.dmp

        Filesize

        252KB

      • memory/2364-82-0x00007FF965800000-0x00007FF9668AB000-memory.dmp

        Filesize

        16.7MB

      • memory/2364-83-0x00007FF96E7D0000-0x00007FF96E7F1000-memory.dmp

        Filesize

        132KB

      • memory/2364-85-0x00007FF96D960000-0x00007FF96D971000-memory.dmp

        Filesize

        68KB

      • memory/2364-84-0x00007FF96E6D0000-0x00007FF96E6E8000-memory.dmp

        Filesize

        96KB

      • memory/2364-87-0x00007FF96D920000-0x00007FF96D931000-memory.dmp

        Filesize

        68KB

      • memory/2364-86-0x00007FF96D940000-0x00007FF96D951000-memory.dmp

        Filesize

        68KB

      • memory/2364-88-0x00007FF96D900000-0x00007FF96D91B000-memory.dmp

        Filesize

        108KB

      • memory/2364-89-0x00007FF96D8E0000-0x00007FF96D8F1000-memory.dmp

        Filesize

        68KB

      • memory/2364-90-0x00007FF96D8C0000-0x00007FF96D8D8000-memory.dmp

        Filesize

        96KB

      • memory/2364-91-0x00007FF96D890000-0x00007FF96D8C0000-memory.dmp

        Filesize

        192KB

      • memory/2364-92-0x00007FF96D820000-0x00007FF96D887000-memory.dmp

        Filesize

        412KB

      • memory/2364-93-0x00007FF9691B0000-0x00007FF96921F000-memory.dmp

        Filesize

        444KB

      • memory/2364-94-0x00007FF96D800000-0x00007FF96D811000-memory.dmp

        Filesize

        68KB

      • memory/2364-72-0x00007FF9668B0000-0x00007FF966B64000-memory.dmp

        Filesize

        2.7MB

      • memory/2364-96-0x00007FF969990000-0x00007FF9699B8000-memory.dmp

        Filesize

        160KB

      • memory/2364-97-0x00007FF9686E0000-0x00007FF968704000-memory.dmp

        Filesize

        144KB

      • memory/2364-74-0x00007FF9841D0000-0x00007FF9841E7000-memory.dmp

        Filesize

        92KB

      • memory/2364-73-0x00007FF986800000-0x00007FF986818000-memory.dmp

        Filesize

        96KB

      • memory/2364-129-0x00007FF965160000-0x00007FF9651C1000-memory.dmp

        Filesize

        388KB

      • memory/2364-104-0x00007FF9657D0000-0x00007FF9657F1000-memory.dmp

        Filesize

        132KB

      • memory/2364-106-0x00007FF9657B0000-0x00007FF9657C3000-memory.dmp

        Filesize

        76KB

      • memory/2364-102-0x00007FF9673F0000-0x00007FF967402000-memory.dmp

        Filesize

        72KB

      • memory/2364-111-0x00007FF965650000-0x00007FF96578B000-memory.dmp

        Filesize

        1.2MB

      • memory/2364-113-0x00007FF965620000-0x00007FF96564C000-memory.dmp

        Filesize

        176KB

      • memory/2364-115-0x00007FF965300000-0x00007FF9654B2000-memory.dmp

        Filesize

        1.7MB

      • memory/2364-117-0x00007FF9655C0000-0x00007FF96561C000-memory.dmp

        Filesize

        368KB

      • memory/2364-108-0x00007FF965790000-0x00007FF9657A2000-memory.dmp

        Filesize

        72KB

      • memory/2364-118-0x00007FF9655A0000-0x00007FF9655B1000-memory.dmp

        Filesize

        68KB

      • memory/2364-120-0x00007FF965260000-0x00007FF9652F7000-memory.dmp

        Filesize

        604KB

      • memory/2364-124-0x00007FF964120000-0x00007FF964351000-memory.dmp

        Filesize

        2.2MB

      • memory/2364-126-0x00007FF965220000-0x00007FF965255000-memory.dmp

        Filesize

        212KB

      • memory/2364-127-0x00007FF9651F0000-0x00007FF965215000-memory.dmp

        Filesize

        148KB

      • memory/2364-122-0x00007FF965580000-0x00007FF965592000-memory.dmp

        Filesize

        72KB

      • memory/2364-128-0x00007FF9651D0000-0x00007FF9651E1000-memory.dmp

        Filesize

        68KB

      • memory/2364-100-0x00007FF967410000-0x00007FF967421000-memory.dmp

        Filesize

        68KB

      • memory/2364-132-0x00007FF965120000-0x00007FF965132000-memory.dmp

        Filesize

        72KB

      • memory/2364-131-0x00007FF965140000-0x00007FF965151000-memory.dmp

        Filesize

        68KB

      • memory/2364-71-0x00007FF980110000-0x00007FF980144000-memory.dmp

        Filesize

        208KB

      • memory/2364-99-0x00007FF967430000-0x00007FF967453000-memory.dmp

        Filesize

        140KB

      • memory/2392-15-0x00007FF970F20000-0x00007FF9719E1000-memory.dmp

        Filesize

        10.8MB

      • memory/2392-69-0x00007FF970F20000-0x00007FF9719E1000-memory.dmp

        Filesize

        10.8MB

      • memory/4612-0-0x0000000000DA0000-0x0000000000DDE000-memory.dmp

        Filesize

        248KB

      • memory/4612-1-0x00007FF970F20000-0x00007FF9719E1000-memory.dmp

        Filesize

        10.8MB

      • memory/4612-14-0x00007FF970F20000-0x00007FF9719E1000-memory.dmp

        Filesize

        10.8MB