chaos | 3688345fc9eaee1073bfb24872d397a180a784e263b7a3b0ef91a8cd2bdad747

Resubmissions

18-04-2024 20:00

240418-yrb27sef61 10

29-03-2024 09:48

23-03-2024 00:07

19-03-2024 21:11

19-03-2024 21:07

Analysis

max time kernel
41s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware.exe
Size

127KB
MD5

6f014d20774a7ec9869e54fe3d977f11
SHA1

2f05737ded3e8f2a6c7468482a6d500ec32d7d30
SHA256

3688345fc9eaee1073bfb24872d397a180a784e263b7a3b0ef91a8cd2bdad747
SHA512

c67358c788beab21c192032fd157dbfaa81398c719a4d4091d49bef2d02c364760f1fac23721e433d7d10a7f25779db143a5f4f68cc07a500e14cb6b544852a8
SSDEEP

1536:KNboAHq9CTesdi+y1WAPoRD9AuH7x9Z2eVGjzfnvI7BpxZe2WyKlsEX7xuTI3:ulHq9CliXWAPEV9Ue4znvqg2WVrxua

Score

10^/10

chaos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/4624-0-0x0000000000590000-0x00000000005B6000-memory.dmp	family_chaos
behavioral1/memory/4624-2-0x00000000026B0000-0x00000000026C0000-memory.dmp	family_chaos
behavioral1/files/0x000100000002a772-7.dat	family_chaos

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1704	bcdedit.exe
2308	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1288	wbadmin.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3900	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1637591879-962683004-3585269084-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1xrzdva7b.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1000	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6292	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4624	Ransomware.exe
3900	svchost.exe
6564	vlc.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
4624	Ransomware.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe
3900	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6564	vlc.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	Ransomware.exe
Token: SeDebugPrivilege	3900	svchost.exe
Token: SeBackupPrivilege	3204	vssvc.exe
Token: SeRestorePrivilege	3204	vssvc.exe
Token: SeAuditPrivilege	3204	vssvc.exe
Token: SeIncreaseQuotaPrivilege	676	WMIC.exe
Token: SeSecurityPrivilege	676	WMIC.exe
Token: SeTakeOwnershipPrivilege	676	WMIC.exe
Token: SeLoadDriverPrivilege	676	WMIC.exe
Token: SeSystemProfilePrivilege	676	WMIC.exe
Token: SeSystemtimePrivilege	676	WMIC.exe
Token: SeProfSingleProcessPrivilege	676	WMIC.exe
Token: SeIncBasePriorityPrivilege	676	WMIC.exe
Token: SeCreatePagefilePrivilege	676	WMIC.exe
Token: SeBackupPrivilege	676	WMIC.exe
Token: SeRestorePrivilege	676	WMIC.exe
Token: SeShutdownPrivilege	676	WMIC.exe
Token: SeDebugPrivilege	676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	676	WMIC.exe
Token: SeRemoteShutdownPrivilege	676	WMIC.exe
Token: SeUndockPrivilege	676	WMIC.exe
Token: SeManageVolumePrivilege	676	WMIC.exe
Token: 33	676	WMIC.exe
Token: 34	676	WMIC.exe
Token: 35	676	WMIC.exe
Token: 36	676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	676	WMIC.exe
Token: SeSecurityPrivilege	676	WMIC.exe
Token: SeTakeOwnershipPrivilege	676	WMIC.exe
Token: SeLoadDriverPrivilege	676	WMIC.exe
Token: SeSystemProfilePrivilege	676	WMIC.exe
Token: SeSystemtimePrivilege	676	WMIC.exe
Token: SeProfSingleProcessPrivilege	676	WMIC.exe
Token: SeIncBasePriorityPrivilege	676	WMIC.exe
Token: SeCreatePagefilePrivilege	676	WMIC.exe
Token: SeBackupPrivilege	676	WMIC.exe
Token: SeRestorePrivilege	676	WMIC.exe
Token: SeShutdownPrivilege	676	WMIC.exe
Token: SeDebugPrivilege	676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	676	WMIC.exe
Token: SeRemoteShutdownPrivilege	676	WMIC.exe
Token: SeUndockPrivilege	676	WMIC.exe
Token: SeManageVolumePrivilege	676	WMIC.exe
Token: 33	676	WMIC.exe
Token: 34	676	WMIC.exe
Token: 35	676	WMIC.exe
Token: 36	676	WMIC.exe
Token: SeBackupPrivilege	4372	wbengine.exe
Token: SeRestorePrivilege	4372	wbengine.exe
Token: SeSecurityPrivilege	4372	wbengine.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe
6564	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6564	vlc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3900	4624	Ransomware.exe	80
PID 4624 wrote to memory of 3900	4624	Ransomware.exe	80
PID 3900 wrote to memory of 2080	3900	svchost.exe	82
PID 3900 wrote to memory of 2080	3900	svchost.exe	82
PID 2080 wrote to memory of 1000	2080	cmd.exe	84
PID 2080 wrote to memory of 1000	2080	cmd.exe	84
PID 2080 wrote to memory of 676	2080	cmd.exe	87
PID 2080 wrote to memory of 676	2080	cmd.exe	87
PID 3900 wrote to memory of 2076	3900	svchost.exe	89
PID 3900 wrote to memory of 2076	3900	svchost.exe	89
PID 2076 wrote to memory of 1704	2076	cmd.exe	91
PID 2076 wrote to memory of 1704	2076	cmd.exe	91
PID 2076 wrote to memory of 2308	2076	cmd.exe	92
PID 2076 wrote to memory of 2308	2076	cmd.exe	92
PID 3900 wrote to memory of 2064	3900	svchost.exe	93
PID 3900 wrote to memory of 2064	3900	svchost.exe	93
PID 2064 wrote to memory of 1288	2064	cmd.exe	95
PID 2064 wrote to memory of 1288	2064	cmd.exe	95
PID 3900 wrote to memory of 6292	3900	svchost.exe	99
PID 3900 wrote to memory of 6292	3900	svchost.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:676
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1704
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1288
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1952

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SubmitMeasure.rm"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6564

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\01c7dab75f9641cd85beaf2e645f7cd6 /t 6692 /p 6564
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Ransomware.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\read_it.txt

Filesize
582B

MD5
ed5cc52876db869de48a4783069c2a5e

SHA1
a9d51ceaeff715ace430f9462ab2ee4e7f33e70e

SHA256
45726f2f29967ef016f8d556fb6468a577307d67388cc4530295a9ca10fdfa36

SHA512
1745aefb9b4db4cdd7c08ee3a7d133db08f35a336fd18b598211519b481ef25ac84a3e8a3da3db06caef9f531288d1cf0ca8d4b2560637945e7953e8b45421f5

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
127KB

MD5
6f014d20774a7ec9869e54fe3d977f11

SHA1
2f05737ded3e8f2a6c7468482a6d500ec32d7d30

SHA256
3688345fc9eaee1073bfb24872d397a180a784e263b7a3b0ef91a8cd2bdad747

SHA512
c67358c788beab21c192032fd157dbfaa81398c719a4d4091d49bef2d02c364760f1fac23721e433d7d10a7f25779db143a5f4f68cc07a500e14cb6b544852a8

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
78B

MD5
3b877d3673b5b43fe8f62d2e056b5b28

SHA1
544f99e75a7cbb0078afa51ac508db5906bd2948

SHA256
8045c9273a507fcd26923532c21b3c11e53225f53ca176e965a84a3806c2d0fd

SHA512
9c1bd66258d8f8e1ce2ecb8f7e089158e9013f9dd957dd62643c504d49150afff04f4a7445edbf49fc5c47b52da86b5281484a8250b0e04394831fc89b4b9746

Download Submit
C:\Users\Admin\Desktop\AddClear.mov.l50m

Filesize
485KB

MD5
389089be1efcba43ec9e553f4476b01a

SHA1
3c0d421bbba2b2cf3560ef94b2c975e41d03da27

SHA256
47749b20937c627f60ceefb55d5ebdc7eb6140b1ae89faf4246e5c358dd7f846

SHA512
5a8ba673a1acc72cdeb4cae22879c07768d8477589541189a302b93833b1f0edcf3970cdce146682709ee026b00c91e9a498908b6dbf4df8822e65e8ac4bceab

Download Submit
C:\Users\Admin\Desktop\ConnectDisable.png.p48l

Filesize
563KB

MD5
6e3f1e133c8c08aed4ab4c5242cf7448

SHA1
c981749d38de777e5d1a93b6b10f3aebab23cc1a

SHA256
76ba47a0000f935caa9373ed44beed998af4d58e598bdfe931aac73086b3b46b

SHA512
f117bf961a05bad36e65c740290ad17ca825f90fdacf7edbed708e5f81aba2c66f2174b057bc8531829aa664ff3da78a2caa5577d42ab313119c56e8ee55fa4e

Download Submit
C:\Users\Admin\Desktop\DismountOpen.bin.fxzp

Filesize
511KB

MD5
1be3b42e0ff747a73ed4251a27eb1d5c

SHA1
a0eadc318cf2875a12e94e46604438724282f3dc

SHA256
ff6b8b8a3b9ed386c1efb82377893cae425d9b8c62dc812555f78b3340247f2f

SHA512
dfade50f754fef087ae725ef20dde174c3156b4f19d89934a7d6f70b6cc6f917fa98a05977dbd5643eaf60cd7df270f3f8e6a32fd5bd0d007309d052d29a2276

Download Submit
C:\Users\Admin\Desktop\LockBlock.ico.wxc3

Filesize
537KB

MD5
9b24aaace4853d8639f5826e84bd48fb

SHA1
1cae5f9a72912002fcc3c26ddfa82ba6b3d8b3bf

SHA256
97f649a47436c81ac82e5fe2b7d0a9120173c02f87d8efb825db1c53287f5b97

SHA512
ff17109223c31254c6992d3d4edc7c513263a497d06c3a9835bf0b5f9783ee054ad862a02c26593bda1077f471d347e614445c4fbe0436616669e0294515257e

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk.2fbg

Filesize
2KB

MD5
58734c18a60abedf381a0ff109c7e52a

SHA1
83672b64c0999bcc80d6204ab9a218bdcfc8627a

SHA256
c39135f145dd2e5283cefe226c238ed16812fb132d7575801ecd85fae8bec65f

SHA512
ff09ac265919fa300f9b46059e85be537b1a3ad231bf9e181ce6369a57cd00b16f28fefa10b4da3ab1782c16cd5899859d89172ef76872a2bf438acdc360f4a4

Download Submit
C:\Users\Admin\Desktop\OutDebug.vbs.ajov

Filesize
459KB

MD5
fd165b1e79f80af2f0ad145cd0d92e9a

SHA1
2f0622fa4d0ff91fc0ae855e3920162f3075cff4

SHA256
4f79c3c762966a64e28d8dcc733dc900f5020897ee74f93280fee5cdf8724fd1

SHA512
de918d0924697c9194f8ef7f7613c16dd25c07e4e66d68826753a891793f81b0f25785f7774fef2f5a50dc8f44347a9b3046f585a4753e6439f24bce3f14645a

Download Submit
C:\Users\Admin\Desktop\OutOptimize.m4v.7juf

Filesize
380KB

MD5
9ac82555473ccd6f646616deade83d41

SHA1
0fb062d6d627aa029e8b7dabc074deb3ae7913f3

SHA256
0c1ceb3d7b12f136a01e81517bb696afd6fea1d217321a6359d1bcfb1d128a85

SHA512
f8400b8ab02d254385d0036dc6fbfb3afb7c297e16021e0ac0ea46240162453a906b167bbe19e6bef29863d51fa97b3e1206f9f993cce5a74f460485c778e9b0

Download Submit
C:\Users\Admin\Desktop\OutSet.zip.ch94

Filesize
852KB

MD5
3bd2b6a533e1d06bafffc30626edb25b

SHA1
03b9997c797641c181e2b4ee4df5ce2605cf26a2

SHA256
fb7634227a23165f8b434e02a6ae055cbd250bc57caf1b10fc506e18dc91a6da

SHA512
b98724a4a5360f2baf68ff329c05cc8aa6b1885078c8a7cc6e52fe2c3f4799f01eb73912cb2415d54c212ad57b60774bb64c3808856873b1dad8ad1315c39a63

Download Submit
C:\Users\Admin\Desktop\ReadUnregister.asp.3um3

Filesize
773KB

MD5
174a3f3f9ce922b50c6e380d12e41d4c

SHA1
04650ef071dfdbb10093677b48470a41a8c10ad2

SHA256
ecc7164d293339258b17af2a6f7991f158f974c684466367def8ad3c17955438

SHA512
a38ccf45df89dc7bd8a2fa956fbc74a34cc607f5a9c4568b42ba0b167ef9c6ab7bc98d155b13e3e9d70b9228d0f0966af2bd4727e0f6fc31048189b369dba77b

Download Submit
C:\Users\Admin\Desktop\StopCompress.mpg.6rh7

Filesize
747KB

MD5
e3ca9616043bbdf0c766329b92616e93

SHA1
072920c9350608328648dc92f1e70b5eaa6ce157

SHA256
0322ac3487cda8c55ba1008a227c1ceb2742ed9599ecf53065d92cf933c00852

SHA512
724d63cc02d49fd834ff02b14c8e28b6b62b22fca3c9f348298f26051459bf1ea79331977120acbb5b3388e7f2b9e8f2a36979e08a5b3b232fbef4c2331c2975

Download Submit
C:\Users\Admin\Desktop\StopGrant.txt.ox8c

Filesize
904KB

MD5
8067766a2d88a4f1fcc2fe4eec8ed9b0

SHA1
9bf9be633b48724793ae995a0e50de87bedb9942

SHA256
6ff545c3cf8d6108d7bdd7a432c9581616be4e46a543587f6ffe968404a5be43

SHA512
8cd7f132df62d7cbc8d71470ceeb8226e61f8db832fd9900418e66428fca3d7743ed523955450a212f7d14dd4bb6a04b1faff510a84d9d59f50d8f2618dfb0be

Download Submit
C:\Users\Admin\Desktop\StopMount.jpg.0wsz

Filesize
799KB

MD5
2e47b7bba45220c169c84b5451dd3ed0

SHA1
602a5390d2862a3260a24416d97990d612e4395c

SHA256
84e64d6c1fcda8831252747a7158cdeec40b7898bee33d6468cf0d439d8b6747

SHA512
f41f867daede9700b06ae069e331004e0c33076cc8ac2c6e45664196608c80179a4bb48a3fafac9255d178ef8c7f421d438fdb1c659ea67139b828e588898794

Download Submit
C:\Users\Admin\Desktop\WaitResume.bmp.a05q

Filesize
1.3MB

MD5
5a919e2bc84d2a58e3ef5d5f72a2fc4f

SHA1
027d68a443db2c5db8dc2935a3840a8912e74afd

SHA256
c55553a27caef3c12cb9d5538fdbbba7eb012c03df2e3a47e5ae48c5752d06dc

SHA512
6e53f0143cbd6cdd3da3cb42c07f41a4925aa563ffc1f6de8a1d61cd8e311a540a3aeb763303e4ef4ad2d0064a940818f0522ad74be8106169b13768a11cefe2

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
1B

MD5
d1457b72c3fb323a2671125aef3eab5d

SHA1
5bab61eb53176449e25c2c82f172b82cb13ffb9d

SHA256
8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

SHA512
ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Download Submit
memory/3900-1084-0x00007FFEA6C80000-0x00007FFEA7742000-memory.dmp

Filesize
10.8MB

Download
memory/3900-16-0x00007FFEA6C80000-0x00007FFEA7742000-memory.dmp

Filesize
10.8MB

Download
memory/4624-0-0x0000000000590000-0x00000000005B6000-memory.dmp

Filesize
152KB

Download
memory/4624-2-0x00000000026B0000-0x00000000026C0000-memory.dmp

Filesize
64KB

Download
memory/4624-15-0x00007FFEA6C80000-0x00007FFEA7742000-memory.dmp

Filesize
10.8MB

Download
memory/4624-1-0x00007FFEA6C80000-0x00007FFEA7742000-memory.dmp

Filesize
10.8MB

Download
memory/6564-1131-0x00007FFEA1200000-0x00007FFEA1230000-memory.dmp

Filesize
192KB

Download
memory/6564-1141-0x00007FFEA05F0000-0x00007FFEA0602000-memory.dmp

Filesize
72KB

Download
memory/6564-1107-0x00007FFEB7FA0000-0x00007FFEB7FB8000-memory.dmp

Filesize
96KB

Download
memory/6564-1108-0x00007FFEB7D90000-0x00007FFEB7DA7000-memory.dmp

Filesize
92KB

Download
memory/6564-1109-0x00007FFEAD270000-0x00007FFEAD281000-memory.dmp

Filesize
68KB

Download
memory/6564-1110-0x00007FFEA1910000-0x00007FFEA1927000-memory.dmp

Filesize
92KB

Download
memory/6564-1111-0x00007FFEA1680000-0x00007FFEA1691000-memory.dmp

Filesize
68KB

Download
memory/6564-1112-0x00007FFEA1660000-0x00007FFEA167D000-memory.dmp

Filesize
116KB

Download
memory/6564-1113-0x00007FFEA0820000-0x00007FFEA0A20000-memory.dmp

Filesize
2.0MB

Download
memory/6564-1114-0x00007FFEA1640000-0x00007FFEA1651000-memory.dmp

Filesize
68KB

Download
memory/6564-1115-0x00007FFEA1600000-0x00007FFEA163F000-memory.dmp

Filesize
252KB

Download
memory/6564-1116-0x00007FFEA15D0000-0x00007FFEA15F1000-memory.dmp

Filesize
132KB

Download
memory/6564-1117-0x00007FFEA15B0000-0x00007FFEA15C8000-memory.dmp

Filesize
96KB

Download
memory/6564-1118-0x00007FFEA1590000-0x00007FFEA15A1000-memory.dmp

Filesize
68KB

Download
memory/6564-1119-0x00007FFEA1570000-0x00007FFEA1581000-memory.dmp

Filesize
68KB

Download
memory/6564-1120-0x00007FFE9CE30000-0x00007FFE9DEDB000-memory.dmp

Filesize
16.7MB

Download
memory/6564-1121-0x00007FFEA1550000-0x00007FFEA1561000-memory.dmp

Filesize
68KB

Download
memory/6564-1122-0x00007FFEA1270000-0x00007FFEA128B000-memory.dmp

Filesize
108KB

Download
memory/6564-1123-0x00007FFEA1250000-0x00007FFEA1261000-memory.dmp

Filesize
68KB

Download
memory/6564-1125-0x00007FFEA1230000-0x00007FFEA1248000-memory.dmp

Filesize
96KB

Download
memory/6564-1105-0x00007FFEA1A80000-0x00007FFEA1AB4000-memory.dmp

Filesize
208KB

Download
memory/6564-1132-0x00007FFEA07B0000-0x00007FFEA0817000-memory.dmp

Filesize
412KB

Download
memory/6564-1133-0x00007FFEA0740000-0x00007FFEA07AF000-memory.dmp

Filesize
444KB

Download
memory/6564-1134-0x00007FFEA11E0000-0x00007FFEA11F1000-memory.dmp

Filesize
68KB

Download
memory/6564-1135-0x00007FFEA06E0000-0x00007FFEA0736000-memory.dmp

Filesize
344KB

Download
memory/6564-1136-0x00007FFEA06B0000-0x00007FFEA06D8000-memory.dmp

Filesize
160KB

Download
memory/6564-1137-0x00007FFEA0680000-0x00007FFEA06A4000-memory.dmp

Filesize
144KB

Download
memory/6564-1138-0x00007FFEA0660000-0x00007FFEA0677000-memory.dmp

Filesize
92KB

Download
memory/6564-1139-0x00007FFEA0630000-0x00007FFEA0653000-memory.dmp

Filesize
140KB

Download
memory/6564-1140-0x00007FFEA0610000-0x00007FFEA0621000-memory.dmp

Filesize
68KB

Download
memory/6564-1142-0x00007FFEA05C0000-0x00007FFEA05E1000-memory.dmp

Filesize
132KB

Download
memory/6564-1106-0x00007FFEA1290000-0x00007FFEA1544000-memory.dmp

Filesize
2.7MB

Download
memory/6564-1143-0x00007FFEA05A0000-0x00007FFEA05B3000-memory.dmp

Filesize
76KB

Download
memory/6564-1144-0x00007FFEA0580000-0x00007FFEA0592000-memory.dmp

Filesize
72KB

Download
memory/6564-1145-0x00007FFEA0440000-0x00007FFEA057B000-memory.dmp

Filesize
1.2MB

Download
memory/6564-1146-0x00007FFEA0410000-0x00007FFEA043C000-memory.dmp

Filesize
176KB

Download
memory/6564-1147-0x00007FFEA0250000-0x00007FFEA0402000-memory.dmp

Filesize
1.7MB

Download
memory/6564-1148-0x00007FFEA01F0000-0x00007FFEA024C000-memory.dmp

Filesize
368KB

Download
memory/6564-1150-0x00007FFEA0130000-0x00007FFEA01C7000-memory.dmp

Filesize
604KB

Download
memory/6564-1149-0x00007FFEA01D0000-0x00007FFEA01E1000-memory.dmp

Filesize
68KB

Download
memory/6564-1151-0x00007FFEA0110000-0x00007FFEA0122000-memory.dmp

Filesize
72KB

Download
memory/6564-1152-0x00007FFE9FD00000-0x00007FFE9FF31000-memory.dmp

Filesize
2.2MB

Download
memory/6564-1153-0x00007FFEA00D0000-0x00007FFEA0105000-memory.dmp

Filesize
212KB

Download
memory/6564-1154-0x00007FFEA00A0000-0x00007FFEA00C5000-memory.dmp

Filesize
148KB

Download
memory/6564-1155-0x00007FFE9FCE0000-0x00007FFE9FCF1000-memory.dmp

Filesize
68KB

Download
memory/6564-1156-0x00007FFE9FB60000-0x00007FFE9FBC1000-memory.dmp

Filesize
388KB

Download
memory/6564-1157-0x00007FFE9FCC0000-0x00007FFE9FCD1000-memory.dmp

Filesize
68KB

Download
memory/6564-1158-0x00007FFE9FB40000-0x00007FFE9FB52000-memory.dmp

Filesize
72KB

Download
memory/6564-1160-0x00007FFE9F520000-0x00007FFE9F5BF000-memory.dmp

Filesize
636KB

Download
memory/6564-1159-0x00007FFE9FB20000-0x00007FFE9FB33000-memory.dmp

Filesize
76KB

Download
memory/6564-1161-0x00007FFE9F970000-0x00007FFE9F981000-memory.dmp

Filesize
68KB

Download
memory/6564-1162-0x00007FFE9EC60000-0x00007FFE9ED62000-memory.dmp

Filesize
1.0MB

Download
memory/6564-1163-0x00007FFE9F950000-0x00007FFE9F961000-memory.dmp

Filesize
68KB

Download
memory/6564-1164-0x00007FFE9EAE0000-0x00007FFE9EC58000-memory.dmp

Filesize
1.5MB

Download
memory/6564-1165-0x00007FFE9F930000-0x00007FFE9F947000-memory.dmp

Filesize
92KB

Download
memory/6564-1166-0x00007FFE9E9C0000-0x00007FFE9EAD2000-memory.dmp

Filesize
1.1MB

Download
memory/6564-1167-0x00007FFE9F910000-0x00007FFE9F921000-memory.dmp

Filesize
68KB

Download
memory/6564-1168-0x00007FFE9F500000-0x00007FFE9F511000-memory.dmp

Filesize
68KB

Download
memory/6564-1170-0x00007FFE9F4A0000-0x00007FFE9F4B8000-memory.dmp

Filesize
96KB

Download
memory/6564-1169-0x00007FFE9F4C0000-0x00007FFE9F4D2000-memory.dmp

Filesize
72KB

Download
memory/6564-1171-0x00007FFE9F480000-0x00007FFE9F496000-memory.dmp

Filesize
88KB

Download
memory/6564-1172-0x00007FFE9F450000-0x00007FFE9F479000-memory.dmp

Filesize
164KB

Download
memory/6564-1173-0x00007FFE9F430000-0x00007FFE9F442000-memory.dmp

Filesize
72KB

Download
memory/6564-1104-0x00007FF6C0690000-0x00007FF6C0788000-memory.dmp

Filesize
992KB

Download