Overview

overview

10

Static

static

10

a54a38a9aa...f0.exe

windows7-x64

10

a54a38a9aa...f0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    26s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2024 01:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe

  • Size

    417KB

  • MD5

    3dc9bad7720a01598aa14e55baca7413

  • SHA1

    99668a82a34ec17340fccecbc2ef0985b84704a0

  • SHA256

    a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

  • SHA512

    567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

  • SSDEEP

    6144:Jr9Zzp4MmFrxodIFRfiM6baHcgrRS8gPFYTdOjbGXypU5:Jp4MmxxhfiMzcyRQFYTdqTa

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\welp.txt

Ransom Note
Hello there! All your files are encrypted, but do not worry, if you're not poor that is. If you send us 50$ worth of Bitcoin, you will get a key that will decrypt all your files! Yipeeeee! Contact us at [email protected] After you send the $50 worth of BTC to the wallet, you will receive the key. Don't try to use any third party software to decrypt your files if you don't want to lose all your data.

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
    "C:\Users\Admin\AppData\Local\Temp\a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Users\Admin\AppData\Roaming\quantum.exe
      "C:\Users\Admin\AppData\Roaming\quantum.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\welp.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\quantum.exe
    Filesize

    417KB

    MD5

    3dc9bad7720a01598aa14e55baca7413

    SHA1

    99668a82a34ec17340fccecbc2ef0985b84704a0

    SHA256

    a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

    SHA512

    567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

    Download Submit

  • C:\Users\Admin\Documents\welp.txt
    Filesize

    427B

    MD5

    025e685a33afef1bb7772b41f46d5700

    SHA1

    39c246daf9003a7a38cfb2edb5f66b2766c65c39

    SHA256

    fc4d2fe0b5c84f7ffa475e1cf9da6185e8bb162a03899bcfe015df64778cc380

    SHA512

    1d3d29da8bb4390ebe563e046d382ced7e1d4abb7870f4a7bee64683d3ae236375492b7ad7fb3e64c800859cf80da43406243f2e5bd36bc262e7bff1e5168b29

    Download Submit

  • memory/4120-14-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4120-24-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4120-490-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4336-0-0x00007FFF68253000-0x00007FFF68255000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4336-1-0x0000000000170000-0x00000000001DE000-memory.dmp

    Filesize

    440KB

    Download