chaos | f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db

General

Target

Yashma ransomware builder v1.2.exe
Size

538KB
MD5

13e878ed7e547523cffc5728f6ba4190
SHA1

878ad3025f8ea6b61ad4521782035963b3675a52
SHA256

f9a5a72ead096594c5d59abe706e3716f6000c3b4ebd7690f2eb114a37d1a7db
SHA512

a7fa4f14deb65aa8de18e37e4fba3d2fa6ed696b70c4d0f1f49a65a4d43da76eff0d9a9c4703a6e3c13a37eb5d1a427e43be8c0ea6b1288a50a1c5175d9392c7
SSDEEP

3072:tq0G/vqRT5i2YcRVm16Pn690H7GMgXuD//bFLAkCgkUKEyF9aT5Zt19r+E1/bFLz:U0G/GiWm16YaGMVFLQdD8FLz

Score

10^/10

chaos ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/4924-0-0x0000000000F20000-0x0000000000FAC000-memory.dmp	family_chaos

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Yashma ransomware builder v1.2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Yashma ransomware builder v1.2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Yashma ransomware builder v1.2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Yashma ransomware builder v1.2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Yashma ransomware builder v1.2.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe
4924	Yashma ransomware builder v1.2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	Yashma ransomware builder v1.2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	Yashma ransomware builder v1.2.exe

C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-0-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Filesize
560KB

Download
memory/4924-1-0x00007FFFABA43000-0x00007FFFABA44000-memory.dmp

Filesize
4KB

Download
memory/4924-2-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-3-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-4-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-5-0x00007FFFABA43000-0x00007FFFABA44000-memory.dmp

Filesize
4KB

Download
memory/4924-6-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-7-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-12-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-13-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download
memory/4924-16-0x00007FFFABA40000-0x00007FFFAC42C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing