chaos | hxxp://github[.]com

Resubmissions

14-05-2024 16:40

240514-t6q3fsee9s 10

14-05-2024 16:37

240514-t4w6paee3t 10

Analysis

max time kernel
123s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://github.com

Score

10^/10

chaos ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000234ea-387.dat	family_chaos
behavioral1/memory/784-417-0x00000000008B0000-0x0000000000900000-memory.dmp	family_chaos

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
784	RansomZa3iM.exe
3392	RansomZa3iM.exe
4552	RansomZa3iM.exe
3788	RansomZa3iM.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
87	raw.githubusercontent.com
86	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601782522954824"	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
784	RansomZa3iM.exe
3392	RansomZa3iM.exe
3392	RansomZa3iM.exe
4552	RansomZa3iM.exe
4552	RansomZa3iM.exe
3788	RansomZa3iM.exe
3788	RansomZa3iM.exe
3020	chrome.exe
3020	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3616	2408	chrome.exe	82
PID 2408 wrote to memory of 3616	2408	chrome.exe	82
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4948	2408	chrome.exe	85
PID 2408 wrote to memory of 4420	2408	chrome.exe	86
PID 2408 wrote to memory of 4420	2408	chrome.exe	86
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87
PID 2408 wrote to memory of 380	2408	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8756ab58,0x7ffe8756ab68,0x7ffe8756ab78
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4896 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4704 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5040 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Users\Admin\Downloads\RansomZa3iM.exe
  "C:\Users\Admin\Downloads\RansomZa3iM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Users\Admin\Downloads\RansomZa3iM.exe
  "C:\Users\Admin\Downloads\RansomZa3iM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4580 --field-trial-handle=1924,i,12971470011522914983,16471484413255086702,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2140

C:\Users\Admin\Downloads\RansomZa3iM.exe
"C:\Users\Admin\Downloads\RansomZa3iM.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4552

C:\Users\Admin\Downloads\RansomZa3iM.exe
"C:\Users\Admin\Downloads\RansomZa3iM.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5331bb057fc582d273687e268ab49ecd

SHA1
9cc9d8233abdb0601ebdabd1a3dfbe5740b2c1b2

SHA256
7632ab1d54360e3baf5572b820c88595776e166eb258b6d31bfbb3d92a6ebc17

SHA512
8f88b828c0972a5783230b100029c82f469e7f361f489ee06a8baa31ec2d3fc58a62968a5dd5db7b545d42d19ddd779cdf44c5efec103137b8dd619f54f1ad04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0ab0defed5192c92f4d40d3b0d94d55c

SHA1
d2c9e7909dae9cc15757d8b27d88cb1177742bab

SHA256
cbde08cf904f0b584a440672b433905d631b1e1a4e86d80a8f29b7e47de1c844

SHA512
509334ec3faac3e28573afeca8f2abc8f23e9b32fa5ae1300918c641a16b8788e32a2a41223b4b5db1c7a812e4ccbda808d05d20911179b1533b5f81a235c601

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
38b721571845cc6981b2fbd9f67537b5

SHA1
c913003793b390267e19ad20671efb9fe7a5b891

SHA256
8ba40288d11b0b7f17b382068e275592ef31487cfa8b9f5e4369b57064549e25

SHA512
6244ad1bce370292e65d49b339c0c7ff13a25b8caaf01a54ab19eff2a1511b06615ffac212eaab1c54106d1cb7958bd76de1e69168c6ccd280c16c11314539f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
17e00a4ef3cc46c97d4e9e8ee8f642db

SHA1
079806a437f55bfcfd7e0da43df0846ae25dc39c

SHA256
eb2fd0f6d23147a38f294b359230717a4d6b4c6c204c66fa570c442c90e2ddac

SHA512
c7e7020bf25ff1b1a43ef6130810952549d13c8f84cde2a14c18fddaa37789c3832185f2be3b308440a5ffe66fb6d8537c4c39ac6613dfd30c7cb0bf0b5f6d99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a4d93417d94023aca882e24a8c2d210f

SHA1
dea7fbe2627ed62112de04f772cbb3adaa5fe36b

SHA256
6a797b10f0911bc9b2fe9dde1affdca42eae92dd3e294156520bc34e831d6899

SHA512
df10232eb911039043839f125ca8797f89cc1fed21132e8e2c12932005175f48fc7c94722fccb852726b00079a745e06cbf67aa8fa4be6dce43d7572db2d0cc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d4c722c2dfad6cb0525916fd8054f875

SHA1
2cb4f331c0707b174ab6f90322a073f27dc264fd

SHA256
afa5d1ebe0e54c2e90f78c3733a51b10d6ecc8a29285f2cbd61978c8131167da

SHA512
1bf309623c422e3f72e752b89aa7bbcc81c8dfa394ce337810348d8b758d16bdf76413cb99435cbc37381eadb0751a05491d1ed95488bb378558948a4759917c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
867441983cbc3e68ae1564ce7aaebf4b

SHA1
ccdd1c5071a61142c2c953c8c656d71baadb515c

SHA256
7705034d9fd317c7c686aab41524e83645c862b0993a5f41c7b03497c6009e47

SHA512
8477398be91c2d8c8767dbdca9c637933ee279b50c29660efb55d800ef0f39127ff09cf75536304c8a3337d059d6b6dbec4683c9d876e60c9fbda251386a3cc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5d8f7a98f830fd9c50de4ca8e58b1167

SHA1
84ce01f69485c1bcb97ccdd4fadf042e8494659a

SHA256
187b349693d318b745c7fda4a7eeff94e62af9c831387c5c86498d955f3961de

SHA512
2a15572170f3e0148e72c51e972851a8d628896543195a6464eab2bc3648bbbc4623fe2c49ad9f62f5dfceecf6fe3a6ab43a719dbf9c18c82e9fb094d51e2749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6ce89f6872b66b6064942af4a18439e4

SHA1
f8df966f859729981d05c485399ba221e5a2bdf7

SHA256
5baf55df333083101074f78d4c64aac5231a3bb2a6b2d3cbd2259c555560fa59

SHA512
39e4cf117892dee79b435359069f6ac59336e35ee8c77562ea88fef4fec89e583ee94c7273a253618d1762ff2abe73b1250d1e834a84f581d055fd1d16972c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
13f0d1d41625caa9de9adc3cbbb63bf7

SHA1
946b5e63c347322a355cf2b5b5cc56a17a7b86c5

SHA256
d49923ae3f728ee6166a8af59115564ad082cffaf434632db9a324f8166fef2d

SHA512
77589ed15f4c9038ed35ead4aea552ed2fc0a1629f89ca715f0bdd46d6a6fbac0f9fb00ae1672e943db091ee529a4ee6bb6c4c92a2c1d4b625f83a9270d5be3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
26a7d0f6dbd4f1575025e399e1384fc2

SHA1
02b6c5b9ec2e5bcaa43fa74fc01b4f034990a765

SHA256
ddee7697e687ff19625b39f20fc7b8fbdd3ecc4493d8dc50bff01d89d0c595a0

SHA512
88cdaa40bb7a702e3d2280b6b7db5c66a66565921313e15db6e01fc57f72e6c63fdd7c25fcc948566aebe1d44a47eb3caf85e78abe891c6d91c0dbc11a862a9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
e1a4b8dfdf86ee9057b5fc7b7fa42b9e

SHA1
a27393a992f58c2e0445b88c217975f30261551a

SHA256
1428878a5c002bd3662da6d19ef606b381bea8612d8cfd9c12d3f8fb541a68e5

SHA512
2789c6f5b935918c449a9a835dcbf8aca44362578db16b13be3fff45b73b482b08782fd54fd87324a004be031f361ad61feb213fb1fd8f6b25f2bdad8615dea4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
a0d41053b4ceaf4308e285d3fab3dc12

SHA1
d6bec0937c7191c9727c0af3ba556fea3850febf

SHA256
6937555731e03942223a597e86349a99494436f9d4dd2c809e2cba2e10283eb5

SHA512
1a9e50151b0c2791a62280c084da4a0d6fa04cc542e8f2609ed4d249035191784dce2a4c4eb0e2a01fb6018811ff38550800c6ffc49f8185eaab781915968e68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5856f5.TMP

Filesize
88KB

MD5
cf1adedfac40a322efa2f32774d828f1

SHA1
9b555971211a40d6889adf0d7016085a40ac72d3

SHA256
073efa38a8cddec3105b7969eb697cfc7c2c7b5850efcab448b721e7ce3a6336

SHA512
fd218624f3b2094b2a98eccce07881af465932f39039041daf002ea6b72a1396cac07efc1e894cd26edde7df79b62ac3acf0dda5d007318cf8c5029e4b061162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RansomZa3iM.exe.log

Filesize
226B

MD5
28d7fcc2b910da5e67ebb99451a5f598

SHA1
a5bf77a53eda1208f4f37d09d82da0b9915a6747

SHA256
2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

SHA512
2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

Download Submit
C:\Users\Admin\Downloads\RansomZa3iM.exe

Filesize
294KB

MD5
2d8036195bf8167fd7d014db58a40849

SHA1
bb6319e4d016082168801afa7cc40ce0e92c62ee

SHA256
a941cb8153a35611cccf3e73640e0a0902d5a16363935002f059785347703a28

SHA512
2477624e7418d610b24a8b1b7a408afd0c6e24c8412463f4cce4a99aaa81ddd03adefa9b3f0394cebcf9dca3712cc793210252a44ba93e4c70b9407546ba5242

Download Submit
memory/784-417-0x00000000008B0000-0x0000000000900000-memory.dmp

Filesize
320KB

Download
memory/784-455-0x00007FFE74083000-0x00007FFE74085000-memory.dmp

Filesize
8KB

Download
memory/784-416-0x00007FFE74083000-0x00007FFE74085000-memory.dmp

Filesize
8KB

Download
memory/3392-454-0x00007FFE74080000-0x00007FFE74B41000-memory.dmp

Filesize
10.8MB

Download
memory/3392-476-0x00007FFE74080000-0x00007FFE74B41000-memory.dmp

Filesize
10.8MB

Download