Analysis
-
max time kernel
294s -
max time network
296s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
09-04-2024 21:00
General
-
Target
trabajo escuela.exe
-
Size
614KB
-
MD5
535994874b99eea69b30569bc7176440
-
SHA1
e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5
-
SHA256
79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7
-
SHA512
12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f
-
SSDEEP
12288:YctEagGmcl4gBF1BRnI6hAVebOe1qOX+t4Z3Fy0RMDbXScaTRM:ZR+cl7X1BRnI6hmebOe1qMuJXifu
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 35 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\trabajo escuela.exe"C:\Users\Admin\AppData\Local\Temp\trabajo escuela.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CRYpt0r V3.0.exe"C:\Users\Admin\AppData\Local\Temp\CRYpt0r V3.0.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\LEER IMPORTANTE.txt4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SystemSettingsBroker.exeC:\Windows\System32\SystemSettingsBroker.exe -Embedding1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s SstpSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s RasMan1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD588a10b4186719522a6eb68dbfd83bb30
SHA1c296e7b33b23f7e390326e5fea5ae00c56a80e31
SHA2569d88f33147f8f0c71257b83d9000e58a498d3849d28dcc5841f44b2c8be8bfac
SHA5124af4c9d1e59ff5714e47fc209cda0d830bd20501a623a24fc41fb58aeaf119539faffb4e347da3a80b902d24d5c921fafd3ac01784001962f6bd5e3e9b1eec90
-
Filesize
652KB
MD5f04e2d871aac9bca6b4cbb87a7c4b583
SHA117d06a123d289510e9bbeb9d2ec89da4caa8f9d5
SHA25624761b824fa4baf33ef574f1fff99a72ab5b7e2272aecf365d39b65748b01f6d
SHA512c6624289766aeb87d9a3387130c3afc9c1ddb8f6d1ccc789f14af2d7858303629c1ac75fc89eeceb3069d0e94a0a9242c4ce705f3ec846e8f5be2566f095074a
-
Filesize
1004KB
MD55d150c14105f9f38b44d2f268e84da46
SHA1ca185122431ed9295df40fa63a4dc3a4f59ded77
SHA256f309bc8877f0121dfcf1da56765c22d4e1e383f66b4f131ac4971c25a4acc9fa
SHA512fafb55e246def43954078fea870c20e3c205f4c7d25b307c0aa5fa3836f008be981a82403a74437a99dd4b76e8f4fdc74801a54c815db0c04f215ba3740c2960
-
Filesize
797KB
MD52d8c386b376f6720a39132b4f8ec6726
SHA1946d6a0b28290365dd315de658b7c2702d0eacb5
SHA2563e26d9d255340c1e867eb6348ac580c5328a3101e8e21b7153176e60cb3dd42d
SHA512c4ccd0ea8824c7bfe4ad18a20db9dac9194054723d96c34ef7a0d263ce47203b28ba8735dc0454eba903c85303d982731dee9bad8e47ddf951d4970fbc0a495d
-
Filesize
824KB
MD5f5252e2e04457d4330d7ab91ebe89974
SHA1a83e18acf4fb4c81c990dc947db2e6fff78cc596
SHA256ffc63e38d8f134bc99f6e52b70b6c227a62280498ac339df1a4eaeb89fbccf20
SHA5123e8aac98004a0683751e9510247f3fb826a2fdb8d3ef572d8718ca55792bbced5866b3b9752ed7317e707b0b7e322548171969b365e173da2b0b99b296e078c4
-
Filesize
595KB
MD52ff1bad41fdec927512700d24413f025
SHA170415cbdb5b6728faa385c99b94984d2eb4f6abf
SHA256bd3c18965890c9cf2939c9335371c98763f19789074eb01d9670b47598ac8df9
SHA5123f5ea1436ac6776a9078d2c04d113c0347d0a1830ec3dddaf1f75372bcd436bbf10fda63cf21bebb9c3493818edb7e88b23ff0209a3ec832724319736c471082
-
Filesize
524KB
MD54fa1f0556b17426b2f7b518999bf50d8
SHA15d40b638b1d43e0f6117d749fe2650cf1588515c
SHA2564d62f4cf253c2b35f4c723c007e9e364e7964c762b5e016f6717045c8c97d235
SHA5125d37e3de3858c3bfe2554d52af8a99f498bf9bb89d2b55429de8cb968cc199f635a9bccf9ec0d459debb015ffbe47da88e7d0cbc32f647aad3b06f704f22311d
-
Filesize
584KB
MD5cb0f6009a76bb27ccb177e3b03c39a2f
SHA1b25e38703bfd1499279c70c78e1bb9d764e26098
SHA2561ab96461e3a39f750be52e8c39c4d3fd23c5b2d9bd3e3255ec123083b169820c
SHA512fa8e31ca0880800945cdab08a8550c9cf6c4ea4d26d1068a686fc9ca35e02c77c194c78d10478b8cbf85b4922f7f30828795299e1ca1711b67998fd99923fccd
-
Filesize
483KB
MD5c98dc1fb830269712db8a3e5d7335d3a
SHA1f00672d2a17eaf880e56b8db143a88fc220cbf4a
SHA25649fc7529fbd7aefefc65ac2d0c53b97a786bfe3692bd761f296d4d18c2fc1c4e
SHA5125709c44a2c6f69e76aeca32dbad1b29ef55ccde4b2d327607ddd0fb0f25f7e58c4763baea2062e7985e0e1d497cce999759c3fc29646d4f908e3355232fc941d
-
Filesize
707KB
MD59dde9dc7c98465be821d0543f70437bc
SHA128f9fce84ac15f7083ba6a538a0be72969a2177d
SHA2564bc6f9ae49f743cd0af7410bdd3971b6f3a4ccb45be72ccee9202a541c8500f6
SHA5124703db9e707eb7164c658629253f04903da6b85e7a0d6b1a5a9322b560ae51b2b1bb561f05fc7c9648d744b0003cecd2664f0a306a24515be127abd2d2bca857
-
Filesize
550KB
MD54d8f860d93fa61049172f40c6ae94c59
SHA1e286babce3493ae65bac507c39d692910dad28a1
SHA256bedb1d48e17a54f92009c946acd521294c1f1bf95909ffd08e9d654e16cbaa75
SHA51204af4149635b6acbf8d0682287fc885daab74a0e6197f553c1d00427cb946522f412c45e6023260ef10f35adbc4b7c9dfe6914042999eb98997a1f7b5cd31f3d
-
Filesize
415KB
MD5753f3c7691e9475c945fe85be664e663
SHA1ca14e615637d11270775c437bd48bc65c0caf121
SHA256e84b95ffb8d400968645ee7baca553d166170956c647680f106e4a49fb25237c
SHA512cda60c3f09bbc85cafcc976af41c5a0735861ad995883f3f9ee6a5ae620482389f3187958692b431346457b5e520f2f9a214a16a259d3ba545b3b8216444048c
-
Filesize
460KB
MD52d2fb5619f08bdb22f1c832200de0536
SHA1e636acd7dbadd2c023e66c29ee0cd1fcfbab55cf
SHA2569e705c73cce844251b3b30ab7eded59431434559b0d2360503bc855c7d71615b
SHA5123afcc54fc4f0637efb8404f9c8e1d621ebeecb1d75171e79dad22ef99dfa72c5345b5a49252edebe81e0bbae684e4c426b94f4a525b29d2f21df5593436c6c74
-
Filesize
974KB
MD5cb67fb2d47b70bee36a470e28339945c
SHA154be59454aebc2cb1c578ec66e595f938bf0676d
SHA256bc5d822c055cffe948e955922f364e0c949646521320cad7e6735c199a1607cf
SHA5122546066b3f61aa590ce66d7e0186e3297bd829fc998521c140020103a3cfb017ea333cc40b1bab5eba4e864d5a85e2dd1c42523644e91e756f850218e9068109
-
Filesize
1.1MB
MD5396f9436a2c6cb5d960a7113a16c92c0
SHA11c1ff0f0ad91c430cad4b74663ab38e6bfccfdae
SHA2567512e9b45e0df6cb334e9c11c3d7f159e722559ef6317a625ef0af9812241ce9
SHA512e70ca2aaf02b8f5cb9106cbba87f2a261b39a69c436d631ed11f95465100890c42c0acef1ebd20d2edfdb8af188d92a0f42a000679f9f0e2ed846468af4fd9f8
-
Filesize
685KB
MD529bb3d47453edd7d8a6ff9a1d9694c76
SHA1f576a728311df3bd9fa7fb018a5307b4085bebe8
SHA25627e5ce1d592e6d328581c9c699244d0a5d29e9ceefd3a2889bc92528d06a12b3
SHA51217b89c011cf28a10ab400035de505126ffff5efcee77b6ece837f39a50e0bcdd5ac630c77fb95085c5c365aeddd6e151b707ed6604f24a5a07dcbbbec2dcc698
-
Filesize
674KB
MD53d549055eb06e7d6ad72913c4e722ddb
SHA15a13aa81373eb8ce7db5a7dd90e270379803de8b
SHA256cc51ce01878d2d66777e933e24a32c4f0337b9a9a821a9498fe131a2f39f41f4
SHA512a127fb23391123744a50e8f14cb72d73a02845e2c19ee7d61c9ec2711faf59bbaf804544aff6032d925e6643dc7148bc4f626d6f76231cb59b6b2033c67b25f6
-
Filesize
528KB
MD5b3eb1c3656f05609b8678b4ef6fd9f98
SHA1ec8d38252531404e826c46eeb0fcff914bd148b0
SHA256a442dbebc3a1f95def8575fe4eb1f0ecd76844bc752f8343296cc6edcae6802f
SHA51218dcff7193eb463c8be60e956d456e2658f61637120d0c590bade29a541a8a1e0fe18a1caf42ce1f6f9e507913124d1d16357f0de161c38e3b6a02335b285970
-
Filesize
1.2MB
MD5d7a310227e47ec4727ebf2c95d392be7
SHA101ebee91710eb41faeb8c09a360c1cc329429401
SHA2565cfae70f6bee6c734e758d716ca0423deb2b79a79498ef3b9ef03be4b81533d9
SHA5124ab4ca6174a41a0ea47c8b8cee0f3b092e361f177b3fa87476bb408e135d4a57c856230d46a93c2d9de43df574a47ce2ee5595bbcd875ddaa37f53eb0dd533eb
-
Filesize
494KB
MD5ebc2b1438cf6526b0fcb6eddba3a799c
SHA1ed7cd600dfd81b3d0653bb59b2803c1ddaa0f7b0
SHA2566292ead3a34a066545d3b4f2d49d919aef023ee6df9072ed816c34aae812e7ae
SHA51217227404da7e0619ab4eebdd5ba4ba30c47329a9f13201329b6e3d8f3784de0ce0762ea8021e6a903d731e174b181bb277049d2ad57162e47e67dbce2050b00a
-
Filesize
464KB
MD523bbc2e8497a6bbe050aa6d577df19c9
SHA1d5bdacb087cab25e5abc3d209ac74324857b31c6
SHA2566a134c67b0284e73b243a752a8c7c54034451ea63f549259b613b907d2cbf229
SHA51237fd871d0b78ae9a3005edc6a5c8a410ba7da6ba5828d93ef616fea7759f09e7810ae83890a04e074821e25970c12eb0e177d31aef8be09be6d3d876af1f9f28
-
Filesize
303KB
MD50ab488911c72edbd59fea128abe86b1c
SHA1702b69835b1d169f29a78a46faa03dc48105df83
SHA2563fc022d46c3625cd9db849b99c7f0e675a64aa6132a322716e85e05e9f93ce7d
SHA512d5278645ba6a6e83e02f819f0b657f29c99ea4ea31e3319f738854b5b9044d59a3ff531d495a31854ef7a88e73720c7dc2e78924c6363610d6a64f5635c8d943
-
Filesize
764KB
MD5ceff7a61b56cb0f9b6b27b919bf86da0
SHA1edf23f7a7c4d83a465aa29dd72b9cc0f990fcb6f
SHA256fc21ab59049547f45b3d37f8012036c0d4749dc5af6374d2d2ade8301ab154e9
SHA5123ec3a1241778aa3976228dd2c77367bdec910fcf3ac2a8d0ab961b99caaec4058318c3b365357dfc572a4969f18bfb105efab7ee1e880fde9709e394d5e9f9e7
-
Filesize
820KB
MD567b764dd6fb4768ccfee73eb7ff8d42b
SHA1ef91ac370ddd3e9e54acbceb632208cf5cd8a9cc
SHA256cad8c551362131da5b4b6da95b4d35168e537bc77e3eb49abe86dae9effe7de6
SHA512e85b6aade7cc65251b82df7b93ad28fb3df1207b4fae82a9077b179993e24d89b636c2b575b19eec7baefabbb79949296c7b656e176129c3be9ca61221fc1a9d
-
Filesize
584B
MD5e43b8bf0caeb3c5f20e115ad0aa983ec
SHA1bc83c09acfb23951d02d87579af8a38c8e398aef
SHA2569c469e0d868136f4a3ad5bdb4c7617dc57239ff0436d55a52d3d60be164b1657
SHA51269c564b2ebd1b3aa0200b3b6c223f0a0e02eb49f8e3dc0bd06947ef4bc7b23c1f5673df4383fd4bab0dc4c89a907a61627562f962e921255017c7caeb54e4663
-
Filesize
1KB
MD5c330fe6230777cc10704e18bc35f4b5a
SHA103003156eefe7b2224afc900d58e15ac62f43fea
SHA256fc668aa6ea357639d9cf3320018dededde311a70b8d12932907dfa0416c4dc14
SHA512bd719db8e6e73f8c7feae0fb1b5b4592c789468f34aa7dfb7ce603e2c2fe3f43542687c533fb542e8f6fbf652ab5d8e818f91049d93343971038f648ddb5bc10
-
Filesize
2KB
MD5cc4091e6c2db6f03d6ebfc8890dde1c5
SHA185307f8977006c22a1539ba12671fbf63f529b60
SHA256ef022cb2cc127b3f15c91cd1d55d26e00a7618bbb4f2b9fa01f1d1761c5cce2d
SHA5129eafea4dc88c8a27454e8ea49adc9bc57e137c7638fda67f1eb133004388947e4b67c58da0c6b8c4dd843a76662cb65e21a7bcc15dc1177fef0bc592fcdeaf84
-
Filesize
1KB
MD5378d5eb396bad59cedb775b654b73f86
SHA1834ab43c146714970afdd0a56baf7bcf950907bc
SHA256da5307b682e417bddd90c7dc18f40e14e0b6eceee588113156f09b7f355a11c7
SHA512c45465a3c95a0e7c0423d616ea4e20172d2db285595edf6a0d23e06e8fce9c0c943abd20f1f44f7f08eb42fc1c17e27e3134183172ffc48949e2840de82073a6
-
Filesize
3KB
MD5b245b38a50b993f1e40d8fbe0ce21c5e
SHA1d8bffc3eb2a28b3450a4aef2cb612cc9250ced22
SHA2569489d2a66984e5879f368739808338c624e912ccb13504e2add902ca1da885d6
SHA51264d875e9e9340ac6009b3d55aee48540ff1f05c883585bb1892089dbdb3ed1f5f6b5f3701d54366689d363b923effe168f17c4a10d42d5912ec26a11777c1153
-
Filesize
1KB
MD5c03a3e5a7de96efe82841a33eac11911
SHA1c89ede970cd4ce5c22cd79b0826e940f6242b8c5
SHA25668bfea7bf00adf9deee2c9b7754b490f69924e8662623787ae5e122f10ccd5d6
SHA5121d0d9454952d93334035ccef330db8ef33b4453ea59d7d749e00ba32b19c7aaf3d84260da0f5d1a6e5476dc520f5c1f27f4660cb89b5ce3c00a667523c9630fa
-
Filesize
436B
MD56ab77bdbbb388fe4ec77f870aa56fdb0
SHA18adf4658c4b07d69472fa6dc906e681a8994ecf6
SHA25690387bd1479a7b410dcce6011f3c45545843f1c99820b5131c53e6d0b850e1c3
SHA5124af4966d015a31726179e3835ddd514e0cc5936eb309cffdccfe4d947ca6dc56edb9f7d6805d8be4297983722f2ad08fb894728bd1646d9907d4b19258b45e01
-
Filesize
22KB
MD580648b43d233468718d717d10187b68d
SHA1a1736e8f0e408ce705722ce097d1adb24ebffc45
SHA2568ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380
SHA512eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9
-
Filesize
9.9MB
-
Filesize
1024KB
-
Filesize
9.9MB
-
Filesize
1024KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
680KB
