Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 17:30
General
-
Target
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe
-
Size
244KB
-
MD5
751df604e41a7e473fd3817b4c16d5f6
-
SHA1
30d6eacf97d1a5e6ec191f75a8eb16d9da54f218
-
SHA256
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e
-
SHA512
6c546d46e6b7c0adffee2bdcf2b85b786b57fbf73c4213e39bf54e4ceaceaa5f143e0e9d57d0398464074e46c0242bd649fa80615d1dc3db32f08b061a7629d7
-
SSDEEP
6144:8+jn7PfWDycKPudCuS74kvw6Mr9zmduLb+70pKXQl29ur4cm:8+gycSzre2q+70pKXQl29ur4c
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe"C:\Users\Admin\AppData\Local\Temp\be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe"C:\Users\Admin\AppData\Local\Temp\PerfWaston2.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD57f0b75bd98b323f54ed6b283a49b69b5
SHA19b09f703a968c5001665657557ce402c60b95e54
SHA256725ff72b2dccc79b7d2b3dc0ef346d992ec46bd022eeb628318a954cc4309241
SHA512e2397905fa9ed4a94fa573ce1bb4b4da830b9e8461b8231a9e3d5042d41c032eb6760ea31d68bc9cb7f197d1acdf72b16e8f0338f3a504777f6a264c214ed961
-
Filesize
8KB
-
Filesize
272KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB