chaos | cac286e52563a7892d233c1497496594fe50aa8fb4ad73a9def0eb8c351b742d

General

Target

2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
Size

86KB
MD5

8f127c103c5c42664521a9be296a587a
SHA1

c6749246a83f5a63b9e1a4516e6810fc7ecd28e0
SHA256

cac286e52563a7892d233c1497496594fe50aa8fb4ad73a9def0eb8c351b742d
SHA512

ff895ef8a9fa1d7637fb4f7b3a31b8537f5c0238a38f1fc710650e38a12a6a769f303bf89a48cb82d0a60a9e31c32aed1bd568f18cf0c090c8d936d1b5dd5ff2
SSDEEP

1536:fo2scar9wKkrJOzzzzzzzzzzzzzfmzzzzzzzzzzl3C8GeGlzzzzzzzNlzzzzzzzy:foPcar9wx9CkGrdmQklQVrU

Score

10^/10

chaos ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-1-0x0000000000CD0000-0x0000000000CEC000-memory.dmp	family_chaos
C:\Users\Admin\AppData\Roaming\svchost.exe	family_chaos
behavioral1/memory/2520-7-0x0000000000240000-0x000000000025C000-memory.dmp	family_chaos

Detects command variations typically used by ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-1-0x0000000000CD0000-0x0000000000CEC000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
C:\Users\Admin\AppData\Roaming\svchost.exe	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/2520-7-0x0000000000240000-0x000000000025C000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Drops startup file 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2520 svchost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

pid	process
2520	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9u1pvbl6p.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2692 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

svchost.exe

pid process

2520 svchost.exe

pid	process
2692	NOTEPAD.EXE

pid	process
2520	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exesvchost.exe

pid	process
2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
2520	svchost.exe
2520	svchost.exe
2520	svchost.exe
2520	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
Token: SeDebugPrivilege	2520	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exesvchost.exe

description	pid	process	target process
PID 2100 wrote to memory of 2520	2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe	svchost.exe
PID 2100 wrote to memory of 2520	2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe	svchost.exe
PID 2100 wrote to memory of 2520	2100	2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe	svchost.exe
PID 2520 wrote to memory of 2692	2520	svchost.exe	NOTEPAD.EXE
PID 2520 wrote to memory of 2692	2520	svchost.exe	NOTEPAD.EXE
PID 2520 wrote to memory of 2692	2520	svchost.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
3⤵
- Opens file in notepad (likely ransom note)
PID:2692

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\read_it.txt
Filesize
94B

MD5
df43b8b8d34e947ec116088fa465702a

SHA1
c145482bf4a7eff15f30617e93b1b4831be1fb30

SHA256
4c3808e41dae9349f472e6cbc8e41c17d12a7b6727cfca9bc941ff0d0b5b6982

SHA512
ac527673757e14ab47ae241e752163915cadbd43983aff56b5da6f38fd29b7940e2906c216f914b2bf541945ebaa0262271d8a927cf96d6bd075e00b936901dc

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
86KB

MD5
8f127c103c5c42664521a9be296a587a

SHA1
c6749246a83f5a63b9e1a4516e6810fc7ecd28e0

SHA256
cac286e52563a7892d233c1497496594fe50aa8fb4ad73a9def0eb8c351b742d

SHA512
ff895ef8a9fa1d7637fb4f7b3a31b8537f5c0238a38f1fc710650e38a12a6a769f303bf89a48cb82d0a60a9e31c32aed1bd568f18cf0c090c8d936d1b5dd5ff2

Download Submit
memory/2100-0-0x000007FEF5D03000-0x000007FEF5D04000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x0000000000CD0000-0x0000000000CEC000-memory.dmp

Filesize
112KB

Download
memory/2520-7-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/2520-12-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-20-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-24-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-25-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads