Overview

overview

10

Static

static

10

666 virus.exe

windows10-2004-x64

10

Resubmissions

21-08-2024 16:23

240821-tvvaqssbrl 10

21-08-2024 15:52

240821-ta3rda1blk 10

22-01-2022 14:10

220122-rgn6fsbfgr 10

Analysis

  • max time kernel
    33s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    666 virus.exe

  • Size

    517KB

  • MD5

    df0edf8b66d6a09c96802357d088d31b

  • SHA1

    4018b609ef6e77c63c4028a12ca66051379b0633

  • SHA256

    3bd7ba1da919719a36e943d1c84a3b976a57d7f4d279b3e81f821f2a5a2e7c40

  • SHA512

    ee67b4e8465118b70820c7048620e82799c447d80f5d0dc97162c94ad7ce26ced0f273d6f18601be8cbf8340066755cff131563d4333bbc7258885addbf436db

  • SSDEEP

    6144:5r9dgxk4gq1z3PX0VP6NaoME0JKeTl0sVSiQYuOk4aqawwwWQG+DBjwww2Ay:MkVq1z/X0VP6NaoMEQl0xYuPNiG+1A

Score
10/10
chaosransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\666 virus.exe
    "C:\Users\Admin\AppData\Local\Temp\666 virus.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4536
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    517KB

    MD5

    df0edf8b66d6a09c96802357d088d31b

    SHA1

    4018b609ef6e77c63c4028a12ca66051379b0633

    SHA256

    3bd7ba1da919719a36e943d1c84a3b976a57d7f4d279b3e81f821f2a5a2e7c40

    SHA512

    ee67b4e8465118b70820c7048620e82799c447d80f5d0dc97162c94ad7ce26ced0f273d6f18601be8cbf8340066755cff131563d4333bbc7258885addbf436db

    Download Submit

  • memory/2132-0-0x00007FFFE4A53000-0x00007FFFE4A55000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2132-1-0x0000000000BA0000-0x0000000000C26000-memory.dmp

    Filesize

    536KB

    Download

  • memory/4536-14-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4536-20-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

    Filesize

    10.8MB

    Download