Overview

overview

10

Static

static

10

2024041404...ry.exe

windows7-x64

10

2024041404...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    84s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-04-2024 09:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20240414042af9c511552255aed26954d500543cchaosdestroyerwannacry.exe

  • Size

    23KB

  • MD5

    042af9c511552255aed26954d500543c

  • SHA1

    e478b331aec1166f16a714e2a4320fcb04d54b16

  • SHA256

    b69bb28aa423914139a3edcf9fdb617f3105d971e628c4cd82bbd62b9fc32b85

  • SHA512

    5729179cce14e135b9e9d79d1acf4e518f2eadff604e5094e9f1eaf9e8c2ef9a3ada18905c55143fe2bbeaf020f3cff3b7e7e9b0845475353fff286a0cefa664

  • SSDEEP

    384:R3Mg/bqo2i5rMfpz0qjuwzUrJXmr91C221gYei:Tqo2Ir8pzRjKd2r9t2xei

Score
10/10
chaosevasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\READ_IT.txt

Ransom Note
[ Oops, Your files have been encrypted! ] WHAT HAPPENED TO MY COMPUTER? Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption key. The ransomware also spread in your Network or USB, You cannot kill or remove the ransomware You can recover your files unless you pay ₱2000 in our GCASH provider and after you send to the designated number with a receipt. You can send it to our email GCASH - https://ibb.co/RHs43WH Email - [email protected]
URLs

https://ibb.co/RHs43WH

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240414042af9c511552255aed26954d500543cchaosdestroyerwannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\20240414042af9c511552255aed26954d500543cchaosdestroyerwannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:752
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3124
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:916
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3676
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:2236
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\READ_IT.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3260
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4680
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1304
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:464
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      23KB

      MD5

      042af9c511552255aed26954d500543c

      SHA1

      e478b331aec1166f16a714e2a4320fcb04d54b16

      SHA256

      b69bb28aa423914139a3edcf9fdb617f3105d971e628c4cd82bbd62b9fc32b85

      SHA512

      5729179cce14e135b9e9d79d1acf4e518f2eadff604e5094e9f1eaf9e8c2ef9a3ada18905c55143fe2bbeaf020f3cff3b7e7e9b0845475353fff286a0cefa664

      Download Submit

    • C:\Users\Admin\Documents\READ_IT.txt
      Filesize

      714B

      MD5

      bab79cb4fc18b75555a407cfbbad1cfb

      SHA1

      884f8d416258fb32d8b54520df694a8b97e38baa

      SHA256

      4922845e5199862745ea771d9905a8ee45592391539eb7663e352d21ca7fc5bd

      SHA512

      2821935fd9a80d3253ec88b7f63ecedc1ae39c54ec081fa2e5ca673ad35ee2316336a995d9fb9dc52c5a07ee0afec98c9c04ee705c3cba7e73298d24f1e81cd9

      Download Submit

    • memory/2328-15-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2328-462-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3084-0-0x0000000000760000-0x000000000076C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3084-1-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3084-14-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

      Filesize

      10.8MB

      Download