Resubmissions
09/08/2024, 10:31
240809-mkfahatbrb1009/08/2024, 01:01
240809-bdhaqsxdqf1009/08/2024, 00:36
240809-ax6l1axbjf10Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
09/08/2024, 10:31
Behavioral task
behavioral1
Sample
FridayBoycrazyV2.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
FridayBoycrazyV2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target FridayBoycrazyV2.exe
- Size 280KB
- Sample240809-mkfahatbrb
- SHA256 0ef2768bdfaa0b953a5c498f18bbf2df5dce249eaf2044474c476c4367c535b5
- MD5 41e34a8240026b4e9cd8d81a73ee8b2c
- SHA1 3876b12e152dd552a7059538242b6f87a23e60f5
- SHA512 a7d610ee4f116121757f47193bf092b639cf2d439dcfa364ea800c28c0f21996fd8baa31c9abe68d2c18cc8f334c57f9d71c4e444a04a27d3b9cab90eecbba73
- SSDEEP 6144:1r93iyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswK:iyJ7/+Wd1kRnFX4mNzxyeOswK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\Warning.txt
Ransom Note
- Your files has been encrypted By FridayBoycrazy and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $100 Dollars can be made in Venmo Or Robux only Please Contact Us At Gmail: [email protected] Discord Username: fridayboycrazy Payment information Venmo Amount: $100 Robux Payment Information: 10,000 Paid Ransom: https://www.roblox.com/game-pass/887175972 Paid Ransom: https://venmo.com/u/gratefulcode
Emails
URLs
-
https://www.roblox.com/game-pass/887175972
-
https://venmo.com/u/gratefulcode
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 3 IoCs
resource yara_rule behavioral1/memory/2848-1-0x0000000000180000-0x00000000001CC000-memory.dmp family_chaos behavioral1/files/0x000c000000012246-5.dat family_chaos behavioral1/memory/2784-7-0x0000000001360000-0x00000000013AC000-memory.dmp family_chaos - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2448 bcdedit.exe 3040 bcdedit.exe -
pid Process 2132 wbadmin.exe - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FridayBoycrazy.url FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini FridayBoycrazy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warning.txt FridayBoycrazy.exe - Executes dropped EXE 1 IoCs
pid Process 2784 FridayBoycrazy.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Music\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini FridayBoycrazy.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Documents\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Videos\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Desktop\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Music\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Videos\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Links\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini FridayBoycrazy.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vl10bfisg.jpg" FridayBoycrazy.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2152 vssadmin.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1332 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2784 FridayBoycrazy.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2848 FridayBoycrazyV2.exe 2848 FridayBoycrazyV2.exe 2848 FridayBoycrazyV2.exe 2784 FridayBoycrazy.exe 2784 FridayBoycrazy.exe 2784 FridayBoycrazy.exe 2784 FridayBoycrazy.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2848 FridayBoycrazyV2.exe Token: SeDebugPrivilege 2784 FridayBoycrazy.exe Token: SeBackupPrivilege 2988 vssvc.exe Token: SeRestorePrivilege 2988 vssvc.exe Token: SeAuditPrivilege 2988 vssvc.exe Token: SeIncreaseQuotaPrivilege 1280 WMIC.exe Token: SeSecurityPrivilege 1280 WMIC.exe Token: SeTakeOwnershipPrivilege 1280 WMIC.exe Token: SeLoadDriverPrivilege 1280 WMIC.exe Token: SeSystemProfilePrivilege 1280 WMIC.exe Token: SeSystemtimePrivilege 1280 WMIC.exe Token: SeProfSingleProcessPrivilege 1280 WMIC.exe Token: SeIncBasePriorityPrivilege 1280 WMIC.exe Token: SeCreatePagefilePrivilege 1280 WMIC.exe Token: SeBackupPrivilege 1280 WMIC.exe Token: SeRestorePrivilege 1280 WMIC.exe Token: SeShutdownPrivilege 1280 WMIC.exe Token: SeDebugPrivilege 1280 WMIC.exe Token: SeSystemEnvironmentPrivilege 1280 WMIC.exe Token: SeRemoteShutdownPrivilege 1280 WMIC.exe Token: SeUndockPrivilege 1280 WMIC.exe Token: SeManageVolumePrivilege 1280 WMIC.exe Token: 33 1280 WMIC.exe Token: 34 1280 WMIC.exe Token: 35 1280 WMIC.exe Token: SeIncreaseQuotaPrivilege 1280 WMIC.exe Token: SeSecurityPrivilege 1280 WMIC.exe Token: SeTakeOwnershipPrivilege 1280 WMIC.exe Token: SeLoadDriverPrivilege 1280 WMIC.exe Token: SeSystemProfilePrivilege 1280 WMIC.exe Token: SeSystemtimePrivilege 1280 WMIC.exe Token: SeProfSingleProcessPrivilege 1280 WMIC.exe Token: SeIncBasePriorityPrivilege 1280 WMIC.exe Token: SeCreatePagefilePrivilege 1280 WMIC.exe Token: SeBackupPrivilege 1280 WMIC.exe Token: SeRestorePrivilege 1280 WMIC.exe Token: SeShutdownPrivilege 1280 WMIC.exe Token: SeDebugPrivilege 1280 WMIC.exe Token: SeSystemEnvironmentPrivilege 1280 WMIC.exe Token: SeRemoteShutdownPrivilege 1280 WMIC.exe Token: SeUndockPrivilege 1280 WMIC.exe Token: SeManageVolumePrivilege 1280 WMIC.exe Token: 33 1280 WMIC.exe Token: 34 1280 WMIC.exe Token: 35 1280 WMIC.exe Token: SeBackupPrivilege 2188 wbengine.exe Token: SeRestorePrivilege 2188 wbengine.exe Token: SeSecurityPrivilege 2188 wbengine.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2784 2848 FridayBoycrazyV2.exe 30 PID 2848 wrote to memory of 2784 2848 FridayBoycrazyV2.exe 30 PID 2848 wrote to memory of 2784 2848 FridayBoycrazyV2.exe 30 PID 2784 wrote to memory of 1732 2784 FridayBoycrazy.exe 32 PID 2784 wrote to memory of 1732 2784 FridayBoycrazy.exe 32 PID 2784 wrote to memory of 1732 2784 FridayBoycrazy.exe 32 PID 1732 wrote to memory of 2152 1732 cmd.exe 34 PID 1732 wrote to memory of 2152 1732 cmd.exe 34 PID 1732 wrote to memory of 2152 1732 cmd.exe 34 PID 1732 wrote to memory of 1280 1732 cmd.exe 37 PID 1732 wrote to memory of 1280 1732 cmd.exe 37 PID 1732 wrote to memory of 1280 1732 cmd.exe 37 PID 2784 wrote to memory of 1288 2784 FridayBoycrazy.exe 39 PID 2784 wrote to memory of 1288 2784 FridayBoycrazy.exe 39 PID 2784 wrote to memory of 1288 2784 FridayBoycrazy.exe 39 PID 1288 wrote to memory of 2448 1288 cmd.exe 41 PID 1288 wrote to memory of 2448 1288 cmd.exe 41 PID 1288 wrote to memory of 2448 1288 cmd.exe 41 PID 1288 wrote to memory of 3040 1288 cmd.exe 42 PID 1288 wrote to memory of 3040 1288 cmd.exe 42 PID 1288 wrote to memory of 3040 1288 cmd.exe 42 PID 2784 wrote to memory of 3020 2784 FridayBoycrazy.exe 43 PID 2784 wrote to memory of 3020 2784 FridayBoycrazy.exe 43 PID 2784 wrote to memory of 3020 2784 FridayBoycrazy.exe 43 PID 3020 wrote to memory of 2132 3020 cmd.exe 45 PID 3020 wrote to memory of 2132 3020 cmd.exe 45 PID 3020 wrote to memory of 2132 3020 cmd.exe 45 PID 2784 wrote to memory of 1332 2784 FridayBoycrazy.exe 49 PID 2784 wrote to memory of 1332 2784 FridayBoycrazy.exe 49 PID 2784 wrote to memory of 1332 2784 FridayBoycrazy.exe 49 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FridayBoycrazyV2.exe"C:\Users\Admin\AppData\Local\Temp\FridayBoycrazyV2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe"C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2152
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2448
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2132
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Warning.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1332
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe
- Size 280KB
- SHA256 0ef2768bdfaa0b953a5c498f18bbf2df5dce249eaf2044474c476c4367c535b5
- MD5 41e34a8240026b4e9cd8d81a73ee8b2c
- SHA1 3876b12e152dd552a7059538242b6f87a23e60f5
- SHA512 a7d610ee4f116121757f47193bf092b639cf2d439dcfa364ea800c28c0f21996fd8baa31c9abe68d2c18cc8f334c57f9d71c4e444a04a27d3b9cab90eecbba73
- SSDEEP 6144:1r93iyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswK:iyJ7/+Wd1kRnFX4mNzxyeOswK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\Warning.txt
- Size 642B
- SHA256 f7b22500b7a82a9446b635353aceecbdc205c9208eeb72c2e2c1b6d0a9a1bd62
- MD5 072e26ca8a9c9502061d1c3d9e3bbeaa
- SHA1 fe55bffddd0d415c293e8e926d302e3586212322
- SHA512 2bc83902a56df2a3178c3b59ad8014a08b282e60289123a10d9a4d643a604876e008e782a6c861bfd211580a5fdbb1bcf748c3197210d71dc18d8949c62d4610
- MD5 SHA1 SHA512