chaos | 376a0dcffbce35c7314ce476ffc708652aed293b82053552f1ac221ab26bd1c6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
Size

417KB
MD5

3dc9bad7720a01598aa14e55baca7413
SHA1

99668a82a34ec17340fccecbc2ef0985b84704a0
SHA256

a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0
SHA512

567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba
SSDEEP

6144:Jr9Zzp4MmFrxodIFRfiM6baHcgrRS8gPFYTdOjbGXypU5:Jp4MmxxhfiMzcyRQFYTdqTa

Score

10^/10

chaos ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\welp.txt

Ransom Note

Hello there! All your files are encrypted, but do not worry, if you're not poor that is. If you send us 50$ worth of Bitcoin, you will get a key that will decrypt all your files! Yipeeeee! Contact us at [email protected] After you send the $50 worth of BTC to the wallet, you will receive the key. Don't try to use any third party software to decrypt your files if you don't want to lose all your data.

Emails

[email protected]

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2304-1-0x0000000000320000-0x000000000038E000-memory.dmp	family_chaos
behavioral1/files/0x00090000000120f8-5.dat	family_chaos
behavioral1/memory/3020-7-0x00000000010C0000-0x000000000112E000-memory.dmp	family_chaos

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quantum.url	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	quantum.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\welp.txt	quantum.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	quantum.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	quantum.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	quantum.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	quantum.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	quantum.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bcz63l3sw.jpg"	quantum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2400	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3020	quantum.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
3020	quantum.exe
3020	quantum.exe
3020	quantum.exe
3020	quantum.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
Token: SeDebugPrivilege	3020	quantum.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3020	2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe	31
PID 2304 wrote to memory of 3020	2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe	31
PID 2304 wrote to memory of 3020	2304	a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe	31
PID 3020 wrote to memory of 2400	3020	quantum.exe	33
PID 3020 wrote to memory of 2400	3020	quantum.exe	33
PID 3020 wrote to memory of 2400	3020	quantum.exe	33

C:\Users\Admin\AppData\Local\Temp\a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe
"C:\Users\Admin\AppData\Local\Temp\a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Roaming\quantum.exe
  "C:\Users\Admin\AppData\Roaming\quantum.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\welp.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\quantum.exe

Filesize
417KB

MD5
3dc9bad7720a01598aa14e55baca7413

SHA1
99668a82a34ec17340fccecbc2ef0985b84704a0

SHA256
a54a38a9aab0bde31b2065d8b88a8e6569cc66c3f6137379b6b5a62361c319f0

SHA512
567581747132d56595c719e4d454bf6e73ba941581701b28287559f899ea5813a0abb7ff2df25cb3d7c99d3203c8a8ab361ea37b3b8e8392748fb855ee4cbaba

Download Submit
C:\Users\Admin\Documents\welp.txt

Filesize
427B

MD5
025e685a33afef1bb7772b41f46d5700

SHA1
39c246daf9003a7a38cfb2edb5f66b2766c65c39

SHA256
fc4d2fe0b5c84f7ffa475e1cf9da6185e8bb162a03899bcfe015df64778cc380

SHA512
1d3d29da8bb4390ebe563e046d382ced7e1d4abb7870f4a7bee64683d3ae236375492b7ad7fb3e64c800859cf80da43406243f2e5bd36bc262e7bff1e5168b29

Download Submit
memory/2304-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/2304-1-0x0000000000320000-0x000000000038E000-memory.dmp

Filesize
440KB

Download
memory/3020-7-0x00000000010C0000-0x000000000112E000-memory.dmp

Filesize
440KB

Download
memory/3020-9-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-13-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-495-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download