chaos | 994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea

General

Target

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
Size

190KB
MD5

50c8525d4becd3e68424f68eae6e6983
SHA1

db8835032d0dcce4b9899671bfa4d8e3ddfc825c
SHA256

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea
SHA512

db51b7735eebb57126eb5640195bf9ebe00acc8914bfd2ef31e7e18bac890da63f46a3773e449766faabb31c865ebfb3cb9473e3800b8079a8204b397ee6ba79
SSDEEP

768:/KHkATXfZLdQeIOi1H88pup5n5uwESIL+aOppppOFb0xRbNqmM9dCgKcpdYRHM/W:j4Xfx+H8hpPuw2qieK9dC3cTKtswB

Score

10^/10

chaos persistence ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3748-1-0x0000000000E60000-0x0000000000E96000-memory.dmp	family_chaos
behavioral2/files/0x000e000000023b51-6.dat	family_chaos

Chaos family
chaos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exesvchost.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 1 IoCs

Processes:

svchost.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid	Process
5088	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Store = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Drops desktop.ini file(s) 16 IoCs

Processes:

svchost.exe

description	ioc	Process
File created	C:\Users\Admin\Links\desktop.ini	svchost.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\Music\desktop.ini	svchost.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File created	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File created	F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	svchost.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File created	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File created	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File created	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File created	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File created	C:\Users\Admin\Desktop\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
4840	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

svchost.exe

pid	Process
5088	svchost.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exesvchost.exe

pid	Process
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe
5088	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
Token: SeDebugPrivilege	5088	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exesvchost.exe

description	pid	Process	procid_target
PID 3748 wrote to memory of 5088	3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe	92
PID 3748 wrote to memory of 5088	3748	994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe	92
PID 5088 wrote to memory of 4840	5088	svchost.exe	94
PID 5088 wrote to memory of 4840	5088	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe
"C:\Users\Admin\AppData\Local\Temp\994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
190KB

MD5
50c8525d4becd3e68424f68eae6e6983

SHA1
db8835032d0dcce4b9899671bfa4d8e3ddfc825c

SHA256
994ab65cf9072f47b962e271c7b5990a5552ca15de1d35b4f2c21b4c698de2ea

SHA512
db51b7735eebb57126eb5640195bf9ebe00acc8914bfd2ef31e7e18bac890da63f46a3773e449766faabb31c865ebfb3cb9473e3800b8079a8204b397ee6ba79

Download Submit
C:\Users\Admin\Pictures\read_it.txt

Filesize
75B

MD5
c4c96e7d10aae1da43f42944209827cf

SHA1
40ce5138fd5ee79c0ffeec8eed6f8596a31625e9

SHA256
ce4eac3c91c6c4948e92dc1590d483db3a39ae1db1943d2fab69c1068623fd9b

SHA512
7ab3600a1b286ef9dee986093bf10580f789ee8f6c72d09b03d6d8eea247ea762ffe4b5445a99c052e586c7e811e72892b01db3de46d9f45a8bbd3df3f992555

Download Submit
memory/3748-1-0x0000000000E60000-0x0000000000E96000-memory.dmp

Filesize
216KB

Download
memory/3748-0-0x00007FFB34543000-0x00007FFB34545000-memory.dmp

Filesize
8KB

Download
memory/5088-14-0x00007FFB34540000-0x00007FFB35001000-memory.dmp

Filesize
10.8MB

Download
memory/5088-122-0x00007FFB34540000-0x00007FFB35001000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads