chaos | 0d9fcb8894240750cb5e4222ea78572aba6618eb5297c2069588ceb979d52d8b

Resubmissions

13-07-2024 09:54

240713-lxcvgawdmn 10

13-07-2024 09:52

240713-lv46yawdkj 10

13-07-2024 09:46

240713-lrz3tayajc 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
Size

400KB
MD5

47e14a46326791625b67704d4329bed6
SHA1

01e0e607678a36d8e7e23d1fb11f8d7aa2c20581
SHA256

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8
SHA512

e979fb4537a7fadbc6583a5cd537ce533111ea4a596bd8486b9fbf551ed7b390271a6218ccf71cd052d4270c1fe1957ec0aae4527c9613a0cdbc0e24641a19a2
SSDEEP

6144:cMr9/U806q0jnjCyc1rIGruapfd7ggZqLuID/pFZwVZ3j:a806qwjCycpIGRpfd8cqCITpFZwD3

Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral10/memory/2872-1-0x0000000000560000-0x00000000005CA000-memory.dmp	family_chaos
C:\Users\Admin\AppData\Roaming\svchost.exe	family_chaos

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2968 bcdedit.exe
1412 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2400 wbadmin.exe

pid	process
2968	bcdedit.exe
1412	bcdedit.exe

pid	process
2400	wbadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 3 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\for dencrypt	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3096 svchost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3096	svchost.exe

Drops desktop.ini file(s) 34 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mue5ihgrk.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2824 vssadmin.exe

pid	process
2824	vssadmin.exe

Modifies registry class 2 IoCs

Processes:

svchost.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

svchost.exe

pid process

3096 svchost.exe

pid	process
3096	svchost.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exesvchost.exe

pid	process
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe
3096	svchost.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exesvchost.exevssvc.exeWMIC.exewbengine.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
Token: SeDebugPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	4984	vssvc.exe
Token: SeRestorePrivilege	4984	vssvc.exe
Token: SeAuditPrivilege	4984	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4640	WMIC.exe
Token: SeSecurityPrivilege	4640	WMIC.exe
Token: SeTakeOwnershipPrivilege	4640	WMIC.exe
Token: SeLoadDriverPrivilege	4640	WMIC.exe
Token: SeSystemProfilePrivilege	4640	WMIC.exe
Token: SeSystemtimePrivilege	4640	WMIC.exe
Token: SeProfSingleProcessPrivilege	4640	WMIC.exe
Token: SeIncBasePriorityPrivilege	4640	WMIC.exe
Token: SeCreatePagefilePrivilege	4640	WMIC.exe
Token: SeBackupPrivilege	4640	WMIC.exe
Token: SeRestorePrivilege	4640	WMIC.exe
Token: SeShutdownPrivilege	4640	WMIC.exe
Token: SeDebugPrivilege	4640	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4640	WMIC.exe
Token: SeRemoteShutdownPrivilege	4640	WMIC.exe
Token: SeUndockPrivilege	4640	WMIC.exe
Token: SeManageVolumePrivilege	4640	WMIC.exe
Token: 33	4640	WMIC.exe
Token: 34	4640	WMIC.exe
Token: 35	4640	WMIC.exe
Token: 36	4640	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4640	WMIC.exe
Token: SeSecurityPrivilege	4640	WMIC.exe
Token: SeTakeOwnershipPrivilege	4640	WMIC.exe
Token: SeLoadDriverPrivilege	4640	WMIC.exe
Token: SeSystemProfilePrivilege	4640	WMIC.exe
Token: SeSystemtimePrivilege	4640	WMIC.exe
Token: SeProfSingleProcessPrivilege	4640	WMIC.exe
Token: SeIncBasePriorityPrivilege	4640	WMIC.exe
Token: SeCreatePagefilePrivilege	4640	WMIC.exe
Token: SeBackupPrivilege	4640	WMIC.exe
Token: SeRestorePrivilege	4640	WMIC.exe
Token: SeShutdownPrivilege	4640	WMIC.exe
Token: SeDebugPrivilege	4640	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4640	WMIC.exe
Token: SeRemoteShutdownPrivilege	4640	WMIC.exe
Token: SeUndockPrivilege	4640	WMIC.exe
Token: SeManageVolumePrivilege	4640	WMIC.exe
Token: 33	4640	WMIC.exe
Token: 34	4640	WMIC.exe
Token: 35	4640	WMIC.exe
Token: 36	4640	WMIC.exe
Token: SeBackupPrivilege	2260	wbengine.exe
Token: SeRestorePrivilege	2260	wbengine.exe
Token: SeSecurityPrivilege	2260	wbengine.exe
Token: SeDebugPrivilege	4952	firefox.exe
Token: SeDebugPrivilege	4952	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	process
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

firefox.exe

pid	process
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe
4952	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

OpenWith.exefirefox.exe

pid	process
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4292	OpenWith.exe
4952	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exesvchost.execmd.execmd.execmd.exeOpenWith.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2872 wrote to memory of 3096	2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe	svchost.exe
PID 2872 wrote to memory of 3096	2872	6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe	svchost.exe
PID 3096 wrote to memory of 2292	3096	svchost.exe	cmd.exe
PID 3096 wrote to memory of 2292	3096	svchost.exe	cmd.exe
PID 2292 wrote to memory of 2824	2292	cmd.exe	vssadmin.exe
PID 2292 wrote to memory of 2824	2292	cmd.exe	vssadmin.exe
PID 2292 wrote to memory of 4640	2292	cmd.exe	WMIC.exe
PID 2292 wrote to memory of 4640	2292	cmd.exe	WMIC.exe
PID 3096 wrote to memory of 948	3096	svchost.exe	cmd.exe
PID 3096 wrote to memory of 948	3096	svchost.exe	cmd.exe
PID 948 wrote to memory of 2968	948	cmd.exe	bcdedit.exe
PID 948 wrote to memory of 2968	948	cmd.exe	bcdedit.exe
PID 948 wrote to memory of 1412	948	cmd.exe	bcdedit.exe
PID 948 wrote to memory of 1412	948	cmd.exe	bcdedit.exe
PID 3096 wrote to memory of 1704	3096	svchost.exe	cmd.exe
PID 3096 wrote to memory of 1704	3096	svchost.exe	cmd.exe
PID 1704 wrote to memory of 2400	1704	cmd.exe	wbadmin.exe
PID 1704 wrote to memory of 2400	1704	cmd.exe	wbadmin.exe
PID 4292 wrote to memory of 272	4292	OpenWith.exe	firefox.exe
PID 4292 wrote to memory of 272	4292	OpenWith.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 272 wrote to memory of 4952	272	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe
PID 4952 wrote to memory of 540	4952	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe
"C:\Users\Admin\AppData\Local\Temp\6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
3⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2824

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
3⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2968

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1032

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\for dencrypt"
2⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\for dencrypt"
3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2092 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1924 -prefsLen 21257 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3e83a81-e6e6-4ffa-a8ac-be681a16cc07} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" gpu
4⤵
PID:540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 21257 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e19ad93-ee67-400f-8d8b-62656229b581} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" socket
4⤵
- Checks processor information in registry
PID:4772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3388 -childID 1 -isForBrowser -prefsHandle 3396 -prefMapHandle 3392 -prefsLen 22482 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {236e2d29-9bd9-40ab-bf4a-d0167eb3f0fc} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:1656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -childID 2 -isForBrowser -prefsHandle 3396 -prefMapHandle 3392 -prefsLen 23287 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9194c5ae-af01-482a-a106-827f2c6ac7c6} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4172 -childID 3 -isForBrowser -prefsHandle 4164 -prefMapHandle 4160 -prefsLen 23521 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f540efb-6439-4b40-b85a-95302ce82632} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4812 -parentBuildID 20240401114208 -prefsHandle 4808 -prefMapHandle 4804 -prefsLen 29589 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8e27d12-f08d-4b76-a4a2-8a98426c860f} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" rdd
4⤵
PID:4976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1580 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5536 -prefMapHandle 4756 -prefsLen 30527 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad0b499b-fd3d-46e7-9057-fd7a26721bdc} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" utility
4⤵
- Checks processor information in registry
PID:5496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3768 -childID 4 -isForBrowser -prefsHandle 3856 -prefMapHandle 3588 -prefsLen 28585 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20478c83-a840-4948-9957-ea1fb83f8db5} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:5704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 5 -isForBrowser -prefsHandle 5820 -prefMapHandle 5824 -prefsLen 28585 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c3b8e5-071f-48b9-92dc-b6ac5dd6874c} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:5736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 6 -isForBrowser -prefsHandle 6092 -prefMapHandle 6088 -prefsLen 28585 -prefMapSize 243020 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0c66117-2a6e-42ee-bea6-5683e2bf9ae7} 4952 "\\.\pipe\gecko-crash-server-pipe.4952" tab
4⤵
PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\om5ozmva.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
49003db302a4cac28a11919af30e072a

SHA1
e3c516dc307871897d8b1ac00374150e984b261a

SHA256
80a09fd43da01d30590c5b2dd211f8835ecf3f1c33eee5136adc32589086eeb8

SHA512
10cf3cd31a45904a289330cfdb1d5a2209ff0785f8b1c15d3ca0a00dc08bdb210274984a394e1a32b408f85aeea85406325683c36db05133ae622b8da882f38f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
11d144b4e8796b37e1312604b381cb4c

SHA1
9d0111dda47d95a3332b6d0e49d927fdbe4b76b4

SHA256
b1b33c868da8579d6c7b7b773af73df74a948db75d534bca5616d98cb54ef742

SHA512
296ab2bebf029fa406736cd807288392833e0227efe9eac06f9fdfeb884ca928d8fbfbdfda232d8d73df265a5fd0491b8d36a0bcd460e71b9f0f507e17d48b99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
6ef9e1c99410b04d189a7534ab1b78ec

SHA1
f191baa153416b0e50c0f3d2364e3818d4157fc0

SHA256
cb1c1cd1413731ca72abc35cbd0faa8bf119f7e301f45b195aaeb60fbdbf3415

SHA512
7222cce64f952fd5fbdc4869fdd7a3e45d4857adf22d57d462f18ab4377ea2ba1bf63c8023ab1ca0eb932c40d2613c6f961c0bdb88e2905fbe9bf155187916d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\datareporting\glean\pending_pings\5bc55cfa-ce99-4251-b35b-cf43bf5509c8

Filesize
566B

MD5
19b071458ce7d0579bf426bc5773fa8c

SHA1
e2bb83c9499283720111d9fb91c81c999a54c1c2

SHA256
f31a445c999d56ef72481bbfccb1787520778b8446aa20d5d296ee5857ac9ee5

SHA512
095d58c57b171665e636357b344d39489b5682ff65a8b6f1defa5c021d176adda94cf760d5b540f0caae0b3c5c079e8edff59002519e5d194d856ef53fb95a92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\extensions.json

Filesize
37KB

MD5
3cfbdd2dff86629999c938a67e6350bd

SHA1
1e86e1f9e62037726274c67b30d5f6332e38410f

SHA256
8c28e047c84d2b3ad62ebda71ff48b6c816173fe7f107a54b35515ca6c48832b

SHA512
4a111eb9fe5873293b713ac766db2d69ced721ea49ea920322f8c33f79f03c957ecdca713fe81de22695b9ec0f2b34163900f7047c6ac4e91fc30c175f2d6c17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\prefs-1.js

Filesize
11KB

MD5
1fbfaa798fa1a4d341d4b70e0e5e5eec

SHA1
f46e7ed5b5b4cdb9609f86877e94c39766900577

SHA256
cf9783bde0e4432ebc82b943209799413379b9611122e029867fc1cb34373585

SHA512
eb59caa5c85e64dd0c70f9739e36d5e3fe32b8ab6d28a84756c2b3cccb9094b2a2b8ead0c1768b8e2d622836ca1b1d830425d735af8bbb30919612304c102ceb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\prefs-1.js

Filesize
11KB

MD5
64ed8356ab33e1465638f3d1b37edefb

SHA1
a3cfcc472181080165b24c620538fd43f54a3fd5

SHA256
13ea280bcc2ba1190ce09b0ab6c0278957e42fed18de79bf4b6f64d27c74dfa0

SHA512
3f982a35b945e11035f105e8bcd963f0a8b031763fe1c1fe1fd8235d3bf0837422be5e377cef0ccbbba17d37b764d154bb14b9c8ecaadf11f765f87ea90f3dc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\prefs.js

Filesize
1KB

MD5
8c821f856388742c6db427f37fba5f82

SHA1
e9e8a7ae66ad92ede36cb37bae00a22b27716844

SHA256
4fab5b3f748df1d5814d278025eae9f03bb3c04eb945732ecabc8f79aa54fdd4

SHA512
ff5e2606962c6babab8e63288ab36af994dcc918bff04fa6655b53199be6787fb378d3b3f40dba726897004247f3f0db1345c701e4e9d9668da8468f97ad7a2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
48KB

MD5
e2f1b7d6fbc5261e11f7c98384c35c34

SHA1
29dfc9e091340c30ca2fe3de8da5ac5e7e56ad2a

SHA256
d696ff21e80c6e25bb75669867d69c26434337b6873a15192f14304ab9fe97a0

SHA512
52107cc1b17a9a49655757e7897267d4e09d65714ba0ac7f715ab2225b6810dc3c6dafd498ecdefb30779ec24b6acc4db2e1226f62ad82d4dce17ee1469e5a58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
152KB

MD5
fb175e5916aa9c1d28777ac7d5fd7a8b

SHA1
1e90179aabbab710530834175ba26b78bc6b0332

SHA256
f6841314010ff5f66bd0829027903438a076be6d442866a18d22990d4befce0e

SHA512
86a7a1ab9e2cd6350085395a8286b513ae0c34df88c19f6f749512d8cf55ff0c8d3de6f52c7409f51d18b637342ecbbd5a792c09f81ccb74a6db9967db199948

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\om5ozmva.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Filesize
366KB

MD5
93472515da649e2148a2ce81db01ebf1

SHA1
1a11391d31c509fe2505f3a480cf651f29fdc1ea

SHA256
1f09cafc950de09365d7313a03b28e3f33da01dbb572f05cc96e6ad6197f818a

SHA512
f6a3d2c5c22169a4a2c5742874ade3907758ec80d6dba7625dfdbb175251073e6ac8aebbf054719bc9ffeaac285722417a3e022a9668ad37864f83f65d6cb639

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
400KB

MD5
47e14a46326791625b67704d4329bed6

SHA1
01e0e607678a36d8e7e23d1fb11f8d7aa2c20581

SHA256
6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8

SHA512
e979fb4537a7fadbc6583a5cd537ce533111ea4a596bd8486b9fbf551ed7b390271a6218ccf71cd052d4270c1fe1957ec0aae4527c9613a0cdbc0e24641a19a2

Download Submit
C:\Users\Admin\Documents\for dencrypt

Filesize
462B

MD5
8649ec15ace934e93b7b02b651bb1ec1

SHA1
0e0d2b07183b05acc18b0ee66a58ff32dade331f

SHA256
13a31e4d4bb979d68c5f40177d3f5fe47644c36ff9f34055935d85363f2cdcba

SHA512
aa9fd932aaff39a2fe7216ee53dd2d474b13cfb133666d5c2dae1c1cbe63d8abadb697b771190d4cdd42bbb52c5dcbd279af43e0e232f0a59fbd4b5b01d3133f

Download Submit
memory/2872-0-0x00007FFAE0533000-0x00007FFAE0535000-memory.dmp

Filesize
8KB

Download
memory/2872-1-0x0000000000560000-0x00000000005CA000-memory.dmp

Filesize
424KB

Download
memory/3096-509-0x00007FFAE0530000-0x00007FFAE0FF1000-memory.dmp

Filesize
10.8MB

Download
memory/3096-14-0x00007FFAE0530000-0x00007FFAE0FF1000-memory.dmp

Filesize
10.8MB

Download