Resubmissions
21-08-2024 16:23
240821-tvvaqssbrl 1021-08-2024 15:52
240821-ta3rda1blk 1022-01-2022 14:10
220122-rgn6fsbfgr 10Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
21-08-2024 15:52
General
-
Target
666 virus.exe
-
Size
517KB
-
MD5
df0edf8b66d6a09c96802357d088d31b
-
SHA1
4018b609ef6e77c63c4028a12ca66051379b0633
-
SHA256
3bd7ba1da919719a36e943d1c84a3b976a57d7f4d279b3e81f821f2a5a2e7c40
-
SHA512
ee67b4e8465118b70820c7048620e82799c447d80f5d0dc97162c94ad7ce26ced0f273d6f18601be8cbf8340066755cff131563d4333bbc7258885addbf436db
-
SSDEEP
6144:5r9dgxk4gq1z3PX0VP6NaoME0JKeTl0sVSiQYuOk4aqawwwWQG+DBjwww2Ay:MkVq1z/X0VP6NaoMEQl0xYuPNiG+1A
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 43 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\666 virus.exe"C:\Users\Admin\AppData\Local\Temp\666 virus.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\666"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD581549db4312d7cd188b54c50f4a897ec
SHA1438699e83c9357ca39925cf8408b32aeefb32b09
SHA2562255330ce5d7ed82f704ddb5bd85b0b8bb1e71552f79de0ddca0c5bbe645bd5c
SHA51299fd9366e9c364785c6365943cde3d7683400bd6e18a1ad2565d75193ec203ac0eadc707f567e0eed0cd420c129019b0ba7d3a1e9988ecec44cc6d20785e14d8
-
Filesize
517KB
MD5df0edf8b66d6a09c96802357d088d31b
SHA14018b609ef6e77c63c4028a12ca66051379b0633
SHA2563bd7ba1da919719a36e943d1c84a3b976a57d7f4d279b3e81f821f2a5a2e7c40
SHA512ee67b4e8465118b70820c7048620e82799c447d80f5d0dc97162c94ad7ce26ced0f273d6f18601be8cbf8340066755cff131563d4333bbc7258885addbf436db
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
1.1MB
-
Filesize
16.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB