Resubmissions

13-07-2024 09:54

240713-lxcvgawdmn 10

13-07-2024 09:52

240713-lv46yawdkj 10

13-07-2024 09:46

240713-lrz3tayajc 10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 09:46

General

  • Target

    942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c.exe

  • Size

    286KB

  • MD5

    ca1c3c08b1291ee31fb47f039ad08129

  • SHA1

    629446ad19eb04f6edb8c576bf007facf4ff249c

  • SHA256

    942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c

  • SHA512

    e1b49a9738d44666dd93f248844e6bfb331db16c171f05af8333852a99e9c335c527effab61e8de796bed9d9199dfccc9c8f0199fc0eb5998eec9e758bb272fa

  • SSDEEP

    384:123MLWHn3kIt/F6Y0p9dpTWJpr91CznHZN0eNQ6Jki2xC5:En3kIX6rp9j+pr9inHD0eNh5

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c.exe
    "C:\Users\Admin\AppData\Local\Temp\942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Roaming\System.exe
      "C:\Users\Admin\AppData\Roaming\System.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\System.exe

    Filesize

    286KB

    MD5

    ca1c3c08b1291ee31fb47f039ad08129

    SHA1

    629446ad19eb04f6edb8c576bf007facf4ff249c

    SHA256

    942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c

    SHA512

    e1b49a9738d44666dd93f248844e6bfb331db16c171f05af8333852a99e9c335c527effab61e8de796bed9d9199dfccc9c8f0199fc0eb5998eec9e758bb272fa

  • C:\Users\Admin\Desktop\read_it.txt

    Filesize

    603B

    MD5

    7084f8453d19df9736848d0eda34e816

    SHA1

    d8b277bc3cc06a58245a466a0d76868116e304a9

    SHA256

    77b2af47c97fd92eef615ec57e655439bf27b2a7dc650438d53577b86f245d25

    SHA512

    614513c17d07d4cf0f108ab66215e40b3eb2fb06caf5892c00d90d1e0f247ec11f34da73c6040a38b3b5f292bd486bb188e90479cb7ecb1920560c62855e6288

  • memory/216-14-0x00007FFCD8280000-0x00007FFCD8D41000-memory.dmp

    Filesize

    10.8MB

  • memory/216-68-0x00007FFCD8280000-0x00007FFCD8D41000-memory.dmp

    Filesize

    10.8MB

  • memory/216-70-0x00007FFCD8280000-0x00007FFCD8D41000-memory.dmp

    Filesize

    10.8MB

  • memory/1672-0-0x00007FFCD8283000-0x00007FFCD8285000-memory.dmp

    Filesize

    8KB

  • memory/1672-1-0x00000000007D0000-0x000000000081E000-memory.dmp

    Filesize

    312KB