Overview

overview

10

Static

static

10

Unconfirme...90.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    781s
  • max time network
    433s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-08-2024 00:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Unconfirmed 307690.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_bybear.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unconfirmed 307690.exe
    "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 307690.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xzkg4noi\xzkg4noi.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES257B.tmp" "c:\Users\Admin\Downloads\CSC3C510352B6D84FB5A88FD7BEBC8C648.TMP"
        3⤵
          PID:3288
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2448
      • C:\Users\Admin\Downloads\fnaf.exe
        "C:\Users\Admin\Downloads\fnaf.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Users\Admin\AppData\Roaming\fnafwayt.exe
          "C:\Users\Admin\AppData\Roaming\fnafwayt.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Sets desktop wallpaper using registry
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3192
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1444
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:1424
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2544
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:3928
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:2192
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3472
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:3280
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_bybear.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:2116
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3824
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:1720
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:1104
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:5004

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
          Filesize

          9KB

          MD5

          713dfce2058d4f37bada7899e2c18c97

          SHA1

          848e4b02280a667b0a29fc7938689d9f3a05d8c2

          SHA256

          d9a81605cc5a8ebef5e6ebdadddce759b96094305e0d56af1a31bd62272ae16f

          SHA512

          235543c4b95747bb27d15db4c12245c58a0920391d7769073b838af39b31d082956e099c9363e81ae36c1564eff673488131af151fa8ef0a8def9fc1fcfc15dc

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
          Filesize

          9KB

          MD5

          b8bf22904669c072edbf55a329cf9306

          SHA1

          c00dfb696d06e04f7e720f3c9460757f77937cc9

          SHA256

          d69a9962ceccf6eef44a35f2f5930bd2b57caaca1bf289adf7563832d3433b7f

          SHA512

          8630be9decfed9a73d3a653fae4cc4b151cfe270951621775db268c181b5baf10a7cb46bac2a0cb17b547c08542d1c23e6ee680a7a99cdea72ac6b7aca033db4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RES257B.tmp
          Filesize

          1KB

          MD5

          aae877d2fb6f577adde79a37ab1ba39c

          SHA1

          f0fdaa3bbfe258a3231b745cb5cd21c255fd3420

          SHA256

          da3d89110b1126a2fedf996a74c24ba0d3f5495ba253fd2fc710aef787c18fc5

          SHA512

          136f7dd16a41da2c8a0f4a3a1a16fd23c680d24edfbded853be3cfd19867c01b76f6f0e422c83d21f6e8a2ae30499ca1238826732147e01195f2e11423db7beb

          Download Submit

        • C:\Users\Admin\AppData\Roaming\sdf.txt
          Filesize

          384KB

          MD5

          dc12006ae8779615b7a7955844f74f0d

          SHA1

          9de1782edb2f4a0dfd137ea6960dd684d3f66473

          SHA256

          c9da80ccadced973123b2c9ccc5a689911c80b8bb13e734ecba2b452c255d154

          SHA512

          6dda171f41815eb9b58ac57ec8affc364ffe8b3c759c692a66a109e2ac2ce88778b2aeb8cf33c69e5a16d42f59f832bea34e2e62cc7abe9fc584c46ca9a8ce5d

          Download Submit

        • C:\Users\Admin\Documents\read_bybear.txt
          Filesize

          964B

          MD5

          4217b8b83ce3c3f70029a056546f8fd0

          SHA1

          487cdb5733d073a0427418888e8f7070fe782a03

          SHA256

          7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

          SHA512

          2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

          Download Submit

        • C:\Users\Admin\Downloads\fnaf.exe
          Filesize

          886KB

          MD5

          b4531c29df99d302843f04f0ff446725

          SHA1

          7198b93fee9e6ac97d5a937dfb5caa309f050604

          SHA256

          71eedf8abba637ffd1b1d5c831351d6b4d077daca610a3452630b476b1b8a6b6

          SHA512

          0ca277f3312987d23def2452705fba42976e476346b1444ca9fbe2e62ec419e68a00e698b1e66ad4c40746c0470e94d423fd7d3df9a3a3d29877befc5a1be13c

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\xzkg4noi\xzkg4noi.0.cs
          Filesize

          462KB

          MD5

          72a50112442956fd7c55302b63b2e101

          SHA1

          7011abeac9f8189b8361c2f560d791a73002fd69

          SHA256

          5f255cebc1317f99a3b71082d6d334ed8dfe98a891c73f4c3f7a79c2ccd998a3

          SHA512

          ce14b21eac0f42bb9c5815330180f28a1c09c4129a314b3b78c79e895047e60b4edfdda3626f0b60dd03de55c27262b4f315ede571fbbeea96fa6410fa920815

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\xzkg4noi\xzkg4noi.cmdline
          Filesize

          332B

          MD5

          1a97b844cc2d6828d5fdca4b78b035ca

          SHA1

          d3976076676b2b8880983bf038e9c6e6239231f8

          SHA256

          42f5781c4d2ff1f4e34970dd50b20290557ff5ba3a3c3d9a7b87a4d738123a13

          SHA512

          202c48e1def43e8e90e3800a1a920ebc481b79a35380117cef4b71b205074a30bda0a8f6b56b8c4813e0c5a9b9f7b96809a694f2eadc289bff4a4725ade9d958

          Download Submit

        • \??\c:\Users\Admin\Downloads\CSC3C510352B6D84FB5A88FD7BEBC8C648.TMP
          Filesize

          1KB

          MD5

          ff183a6f75cc397f5ee9598b20fb287e

          SHA1

          3d216f28f6780645ef87c7b3cb509023f71dedf1

          SHA256

          0b1ec5f7f964b91c481b4bdb588f1e13014b680e7bc3a265ea2479588ef01536

          SHA512

          292a948d62c543b9577251e898d5d731edd84e913d78cf409ac766bea51ca092dbf4b560d74e28f4af7779369726a1966455402b3d8ae85df2ddde108c175c32

          Download Submit

        • memory/768-31-0x0000000000D10000-0x0000000000DF4000-memory.dmp

          Filesize

          912KB

          Download

        • memory/3760-8-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-7-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-6-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-28-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-5-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-1-0x00007FFEE8323000-0x00007FFEE8325000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3760-4-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-3-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-2-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3760-0-0x0000000000100000-0x000000000018E000-memory.dmp

          Filesize

          568KB

          Download