Overview

overview

10

Static

static

10

897be7be18...fb.exe

windows7-x64

10

897be7be18...fb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    10s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-06-2024 23:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    897be7be189a1e444c44535b7dd1f967ff7eb49bec25367efcbed724c76efffb.exe

  • Size

    22KB

  • MD5

    f086fab4e2d6de8255df5a06e0983f4a

  • SHA1

    501c65650b6815fd837f64ce398ff4d8382475e5

  • SHA256

    897be7be189a1e444c44535b7dd1f967ff7eb49bec25367efcbed724c76efffb

  • SHA512

    9c9ef27dc35f684a0d55f3202887a06ae8cb956e154795802034b9add97dbf5faf337680acb6fa96f3f2250cbe5f4f90caa47d9d43e550368b2b3d0403a40a53

  • SSDEEP

    384:e3Mg/bqo2v4Ahp2XTpFZ3OjvJsr91CSYvEe5:cqo2FaDpjOjBsr9W8e5

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomware

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 2 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\897be7be189a1e444c44535b7dd1f967ff7eb49bec25367efcbed724c76efffb.exe
    "C:\Users\Admin\AppData\Local\Temp\897be7be189a1e444c44535b7dd1f967ff7eb49bec25367efcbed724c76efffb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      PID:1948
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
          PID:2980
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:3068
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
              PID:3252
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            3⤵
              PID:552
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:2112
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:1936
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              3⤵
                PID:2932
                • C:\Windows\system32\wbadmin.exe
                  wbadmin delete catalog -quiet
                  4⤵
                  • Deletes backup catalog
                  PID:4820
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\READ_ME.txt
                3⤵
                • Opens file in notepad (likely ransom note)
                PID:1692
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
              PID:3620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:1560
              • C:\Windows\system32\wbengine.exe
                "C:\Windows\system32\wbengine.exe"
                1⤵
                  PID:3132
                • C:\Windows\System32\vdsldr.exe
                  C:\Windows\System32\vdsldr.exe -Embedding
                  1⤵
                    PID:1236
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                      PID:3220

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                      Filesize

                      22KB

                      MD5

                      f086fab4e2d6de8255df5a06e0983f4a

                      SHA1

                      501c65650b6815fd837f64ce398ff4d8382475e5

                      SHA256

                      897be7be189a1e444c44535b7dd1f967ff7eb49bec25367efcbed724c76efffb

                      SHA512

                      9c9ef27dc35f684a0d55f3202887a06ae8cb956e154795802034b9add97dbf5faf337680acb6fa96f3f2250cbe5f4f90caa47d9d43e550368b2b3d0403a40a53

                      Download Submit

                    • C:\Users\Admin\Documents\READ_ME.txt
                      Filesize

                      67B

                      MD5

                      a72ae082b265f256a2a53a8652a356f3

                      SHA1

                      6036049c9bd13bf8a68d92682edd8b0dfa5ea62e

                      SHA256

                      b0303a6a7a6ae276d3aaa16480b14e2cd549e382c21fb80506782186010ef0eb

                      SHA512

                      ac464dd9e7cd5298e2278d592965a863c4489f0a5b45a63929d2b179cd5a7ef9b9b194a3771e0b731cc52154276535008ee03469f31ec144249aebef4ce552c2

                      Download Submit

                    • memory/1300-0-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1300-1-0x0000000000610000-0x000000000061C000-memory.dmp

                      Filesize

                      48KB

                      Download

                    • memory/1948-14-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/1948-462-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

                      Filesize

                      10.8MB

                      Download