Overview

overview

10

Static

static

10

Unconfirme...90.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    389s
  • max time network
    379s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-08-2024 00:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Unconfirmed 307690.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unconfirmed 307690.exe
    "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 307690.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\olknsqpo\olknsqpo.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54C.tmp" "c:\Users\Admin\Downloads\CSC967F0F9543EB491F9CE0B8656AF1B652.TMP"
        3⤵
          PID:1952
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1768
      • C:\Users\Admin\Downloads\fnaf.exe
        "C:\Users\Admin\Downloads\fnaf.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Users\Admin\AppData\Roaming\fnaft.exe
          "C:\Users\Admin\AppData\Roaming\fnaft.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4272
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:2596
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2452
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1192
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1840
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:940
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:628
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:956
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:3728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:3792
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3688
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4212
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2612
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2864
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
          1⤵
            PID:2664
          • C:\Windows\System32\oobe\UserOOBEBroker.exe
            C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
            1⤵
            • Drops file in Windows directory
            PID:4420
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
            1⤵
            • System Location Discovery: System Language Discovery
            PID:2884
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:3816
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1952
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:308
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2736
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1768

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
            Filesize

            9KB

            MD5

            af219248c251b1b3f540a7e71126f8b8

            SHA1

            6fd2f8f514fa8d45894f6d1c1279bb66b1d1e148

            SHA256

            87cd5afaf4fb8e3077fa29cb759e2dd4d796acba64ac39a817ba088d12d124fa

            SHA512

            39cc85a688b5478898082f7b0a0f094e77c27dc1d68dcca90dc4a16dafcb5ca53ef5fff72d0ab142208cfafba74f0116500906cab0316b4a50fcc1b5028c0245

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RES54C.tmp
            Filesize

            1KB

            MD5

            8d0bba194165f96d8393cdde0faed4e3

            SHA1

            8c2cfd1d6779f1e6f70e8dad70f32a3ed8067144

            SHA256

            a3cf78a584f71c2c9bcb7c052a6a499ffc38abdf7f22cdb71850b07834b54312

            SHA512

            a803d9b5ae5ffcd87a6a013522838f152f34a9eaa87a85ab35e7cfd5fcbb276a5253435cdc8662fa5e44ab1a020c9c5714df3b1ef6a6d4db7fb0e01200a740fe

            Download Submit

          • C:\Users\Admin\Documents\read_it.txt
            Filesize

            964B

            MD5

            4217b8b83ce3c3f70029a056546f8fd0

            SHA1

            487cdb5733d073a0427418888e8f7070fe782a03

            SHA256

            7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

            SHA512

            2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

            Download Submit

          • C:\Users\Admin\Downloads\fnaf.exe
            Filesize

            23KB

            MD5

            6c538545dae084cb5e2093e465fecb0c

            SHA1

            76d260b1f9ff4a536774892871ee36bd5a172425

            SHA256

            6925fde895fd99f5f0a8d379e12b3a742a93036f7ae8a4a28958ddf130a9c205

            SHA512

            f63a84dea4d0762a752e9618a7c445bf799ee8464da655acf55d931f63f3605267d9d436468c3b63a8a74322277a253ca38a3da7bb5a576d70345ba95291ff77

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\olknsqpo\olknsqpo.0.cs
            Filesize

            31KB

            MD5

            7cfc313c4692226f76c3a060dd83fac4

            SHA1

            d079fa4b78c607af7b25455e7aec81c776a2426d

            SHA256

            f8ec61a4621debd4acd82ad6ed4762e1934473a82321955b680f52cc95d14c1d

            SHA512

            d6585b8ec8e5ff8026f1fda8900c974bd311a26deabd4b70dc0c618a5b7a637207701edefbaaa579e22a5e864325de35325f826fadb1e98776657cd05740d597

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\olknsqpo\olknsqpo.cmdline
            Filesize

            332B

            MD5

            6c4ec3cff6ddbf78b42f93e4d2c00aee

            SHA1

            1b5e7aed84087bfec5c252890be799fe6c94ad60

            SHA256

            879092b567cd80f066de54f0b4fc21073fc3b5c4bbba0e8d3df994117f9cf10c

            SHA512

            c2031c55fbeb160fbaf6d0a8501eb3424861eaf4a0848d5b4257f3944e13b24705c77d6e8ad07f3e6f34bc42b516c66d6a1e862c9e27878046c364777a83acea

            Download Submit

          • \??\c:\Users\Admin\Downloads\CSC967F0F9543EB491F9CE0B8656AF1B652.TMP
            Filesize

            1KB

            MD5

            ff183a6f75cc397f5ee9598b20fb287e

            SHA1

            3d216f28f6780645ef87c7b3cb509023f71dedf1

            SHA256

            0b1ec5f7f964b91c481b4bdb588f1e13014b680e7bc3a265ea2479588ef01536

            SHA512

            292a948d62c543b9577251e898d5d731edd84e913d78cf409ac766bea51ca092dbf4b560d74e28f4af7779369726a1966455402b3d8ae85df2ddde108c175c32

            Download Submit

          • memory/236-4-0x00007FF823AA0000-0x00007FF824562000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/236-6-0x00007FF823AA0000-0x00007FF824562000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/236-5-0x00007FF823AA3000-0x00007FF823AA5000-memory.dmp

            Filesize

            8KB

            Download

          • memory/236-0-0x00007FF823AA3000-0x00007FF823AA5000-memory.dmp

            Filesize

            8KB

            Download

          • memory/236-3-0x00007FF823AA0000-0x00007FF824562000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/236-2-0x00007FF823AA0000-0x00007FF824562000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/236-499-0x00007FF823AA0000-0x00007FF824562000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/236-1-0x0000000000450000-0x00000000004DE000-memory.dmp

            Filesize

            568KB

            Download

          • memory/5000-27-0x0000000000460000-0x000000000046C000-memory.dmp

            Filesize

            48KB

            Download