chaos | 41aec0ed3bc8bd1d989c22e50b447a88740505fed4113c0ebe4e1e1792fef3d5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd52f625ebf11a32c79f2925bb2b6bd0.exe
Size 64KB
Sample240325-fx196sha45
SHA256 41aec0ed3bc8bd1d989c22e50b447a88740505fed4113c0ebe4e1e1792fef3d5
MD5 dd52f625ebf11a32c79f2925bb2b6bd0
SHA1 381c59f582f006702e1f797fb10cf0e412bb700a
SHA512 49588a8bd9d59b1811332726207b8abc4c6f24918f0c8563e237467ad8450e8727a3f6f0677d8ec0917094df27acd46a59debcc40d8bea9d15956a9000a71254
SSDEEP 1536:uOItYxqnAC6ph6ggxX4elW2GJYfGAQ61INw+:fI+xSL6CfxoZ2GJJAQw+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2900-23-0x0000000000400000-0x000000000040C000-memory.dmp	family_chaos

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	dd52f625ebf11a32c79f2925bb2b6bd0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	顾太望她.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
4748	顾太望她.exe
3268	顾太望她.exe
2900	顾太望她.exe
3968	svchost.exe
1308	svchost.exe

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 2900	4748	顾太望她.exe	93
PID 3968 set thread context of 1308	3968	svchost.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1456	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1308	svchost.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
4748	顾太望她.exe
4748	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
2900	顾太望她.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	dd52f625ebf11a32c79f2925bb2b6bd0.exe
Token: SeDebugPrivilege	4748	顾太望她.exe
Token: SeDebugPrivilege	2900	顾太望她.exe
Token: SeDebugPrivilege	3968	svchost.exe
Token: SeDebugPrivilege	1308	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4748	4288	dd52f625ebf11a32c79f2925bb2b6bd0.exe	89
PID 4288 wrote to memory of 4748	4288	dd52f625ebf11a32c79f2925bb2b6bd0.exe	89
PID 4288 wrote to memory of 4748	4288	dd52f625ebf11a32c79f2925bb2b6bd0.exe	89
PID 4748 wrote to memory of 3268	4748	顾太望她.exe	92
PID 4748 wrote to memory of 3268	4748	顾太望她.exe	92
PID 4748 wrote to memory of 3268	4748	顾太望她.exe	92
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 4748 wrote to memory of 2900	4748	顾太望她.exe	93
PID 2900 wrote to memory of 3968	2900	顾太望她.exe	94
PID 2900 wrote to memory of 3968	2900	顾太望她.exe	94
PID 2900 wrote to memory of 3968	2900	顾太望她.exe	94
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 3968 wrote to memory of 1308	3968	svchost.exe	95
PID 1308 wrote to memory of 1456	1308	svchost.exe	97
PID 1308 wrote to memory of 1456	1308	svchost.exe	97
PID 1308 wrote to memory of 1456	1308	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\dd52f625ebf11a32c79f2925bb2b6bd0.exe
"C:\Users\Admin\AppData\Local\Temp\dd52f625ebf11a32c79f2925bb2b6bd0.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\顾太望她.exe
  "C:\Users\Admin\AppData\Local\Temp\顾太望她.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\顾太望她.exe
    "C:\Users\Admin\AppData\Local\Temp\顾太望她.exe"
    3⤵
    - Executes dropped EXE
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\顾太望她.exe
    "C:\Users\Admin\AppData\Local\Temp\顾太望她.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Drops desktop.ini file(s)
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        6⤵
        Opens file in notepad (likely ransom note)
        
        PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log
Size 617B
SHA256 33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5
MD5 99e770c0d4043aa84ef3d3cbc7723c25
SHA1 19829c5c413fccba750a3357f938dfa94486acad
SHA512 ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39
MD5 SHA1 SHA512

Submit Download

顾太望她.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\顾太望她.exe.log
Size 813B
SHA256 d3973ddbd7d34386e8101731201fbab7390bbd8c54675cbb20a10872c6793c7d
MD5 96fe4ddd2664d187f6785b153cae3708
SHA1 01acdffa481f4ef18a5af43a360ffec81bd9dafd
SHA512 d51cdfdecc33db780945c9e938899fa5587f147f3a1da9aaf7dd615b92eab40b2665c0014bf2397a5c1ecee1617cd72e84a28f6bf49ed0bb6f1d924ddf814bdc
MD5 SHA1 SHA512

Submit Download

顾太望她.exe

Path C:\Users\Admin\AppData\Local\Temp\顾太望她.exe
Size 64KB
SHA256 41aec0ed3bc8bd1d989c22e50b447a88740505fed4113c0ebe4e1e1792fef3d5
MD5 dd52f625ebf11a32c79f2925bb2b6bd0
SHA1 381c59f582f006702e1f797fb10cf0e412bb700a
SHA512 49588a8bd9d59b1811332726207b8abc4c6f24918f0c8563e237467ad8450e8727a3f6f0677d8ec0917094df27acd46a59debcc40d8bea9d15956a9000a71254
SSDEEP 1536:uOItYxqnAC6ph6ggxX4elW2GJYfGAQ61INw+:fI+xSL6CfxoZ2GJJAQw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

read_it.txt

Path C:\Users\Admin\Documents\read_it.txt
Size 964B
SHA256 7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121
MD5 4217b8b83ce3c3f70029a056546f8fd0
SHA1 487cdb5733d073a0427418888e8f7070fe782a03
SHA512 2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740
MD5 SHA1 SHA512

Submit Download

memory/1308-276-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1308-47-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1308-273-0x0000000006760000-0x00000000067F2000-memory.dmp

Download

memory/1308-274-0x0000000005E80000-0x0000000005E8A000-memory.dmp

Download

memory/2900-28-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/2900-23-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2900-40-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3968-41-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3968-46-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4288-0-0x0000000000F90000-0x0000000000FA6000-memory.dmp

Download

memory/4288-2-0x0000000005A40000-0x0000000005ADC000-memory.dmp

Download

memory/4288-17-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4288-4-0x00000000019A0000-0x00000000019AA000-memory.dmp

Download

memory/4288-3-0x00000000034B0000-0x00000000034C0000-memory.dmp

Download

memory/4288-1-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4748-18-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4748-20-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Download

memory/4748-19-0x0000000004D00000-0x0000000004D10000-memory.dmp

Download

memory/4748-21-0x00000000053C0000-0x0000000005964000-memory.dmp

Download

memory/4748-27-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download