Malware Analysis Report

2024-08-06 16:15

Sample ID 240624-m171fsycnf
Target Yashma ransomware builder v1.2.exe
SHA256 f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
Tags
chaos ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db

Threat Level: Known bad

The file Yashma ransomware builder v1.2.exe was found to be: Known bad.

Malicious Activity Summary

chaos ransomware

Chaos Ransomware

Chaos family

Chaos

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-24 10:56

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 10:56

Reported

2024-06-24 10:59

Platform

win10-20240404-en

Max time kernel

133s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\4272278488\2581520266.pri C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe N/A
File created C:\Windows\rescache\_merged\4272278488\2581520266.pri C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe

"C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe"

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe

"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe

"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 163.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.182.143.212:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 212.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 21.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

memory/1340-0-0x00007FF834633000-0x00007FF834634000-memory.dmp

memory/1340-1-0x0000000000C80000-0x0000000000D0C000-memory.dmp

memory/1340-2-0x00007FF834630000-0x00007FF83501C000-memory.dmp

memory/1340-3-0x00007FF834630000-0x00007FF83501C000-memory.dmp

memory/1340-4-0x00007FF834630000-0x00007FF83501C000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.windows.sechealthui_cw5n1h2txyewy\AC\Microsoft\Windows\4272278488\2581520266.pri

MD5 dc37deff2947a4ec8bf9b40a3dc25c49
SHA1 422bdce2dc21c634760c8b06a60c4ebf131cc592
SHA256 00dee1b03565baf7c105f1484f27a2e04d900538c153372482fbedd8cde61d85
SHA512 bbe9730344e0f648c53d2d5c518791ce8d92c1f04e1b9646bb4feca24d5f41fae255eff57ad7c36ff1d26869ad25eede25bbd4e98a59267d41ee71f3885d9dd4

memory/1340-9-0x00007FF834630000-0x00007FF83501C000-memory.dmp