Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 04:06
Behavioral task
behavioral1
Sample
e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi
-
Size
664KB
-
MD5
94d2ef7db81197413140692de0985b00
-
SHA1
e52458822912fbd89249b9dae5b24692b8e67cca
-
SHA256
e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee
-
SHA512
a9ba867949545339e56fd5355681df5dda69b3007d3b6660aa75dc6014a7425d3f000661c6e6a82c899a718eb51cf280616cc718c72d30f5bbb39313f9e9419f
-
SSDEEP
12288:qtVRQ+gjpjegDro8EdWd10DTCW1uF+Sf2ppmvrfOgR7a+9Rd:qt9cpVDhE81ckhmIvrfnUA
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral2/files/0x0007000000023c78-61.dat family_chaos behavioral2/files/0x0007000000023c86-68.dat family_chaos behavioral2/memory/208-70-0x00000000005A0000-0x0000000000606000-memory.dmp family_chaos -
Chaos family
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2808 ICACLS.EXE 1404 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e57e975.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEA31.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\e57e975.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A6E76D20-F7B5-44A1-8148-B4E2790F028C} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE -
Executes dropped EXE 1 IoCs
pid Process 208 keygenran.exe -
Loads dropped DLL 1 IoCs
pid Process 380 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3760 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3904 msiexec.exe 3904 msiexec.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe 208 keygenran.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3760 msiexec.exe Token: SeIncreaseQuotaPrivilege 3760 msiexec.exe Token: SeSecurityPrivilege 3904 msiexec.exe Token: SeCreateTokenPrivilege 3760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3760 msiexec.exe Token: SeLockMemoryPrivilege 3760 msiexec.exe Token: SeIncreaseQuotaPrivilege 3760 msiexec.exe Token: SeMachineAccountPrivilege 3760 msiexec.exe Token: SeTcbPrivilege 3760 msiexec.exe Token: SeSecurityPrivilege 3760 msiexec.exe Token: SeTakeOwnershipPrivilege 3760 msiexec.exe Token: SeLoadDriverPrivilege 3760 msiexec.exe Token: SeSystemProfilePrivilege 3760 msiexec.exe Token: SeSystemtimePrivilege 3760 msiexec.exe Token: SeProfSingleProcessPrivilege 3760 msiexec.exe Token: SeIncBasePriorityPrivilege 3760 msiexec.exe Token: SeCreatePagefilePrivilege 3760 msiexec.exe Token: SeCreatePermanentPrivilege 3760 msiexec.exe Token: SeBackupPrivilege 3760 msiexec.exe Token: SeRestorePrivilege 3760 msiexec.exe Token: SeShutdownPrivilege 3760 msiexec.exe Token: SeDebugPrivilege 3760 msiexec.exe Token: SeAuditPrivilege 3760 msiexec.exe Token: SeSystemEnvironmentPrivilege 3760 msiexec.exe Token: SeChangeNotifyPrivilege 3760 msiexec.exe Token: SeRemoteShutdownPrivilege 3760 msiexec.exe Token: SeUndockPrivilege 3760 msiexec.exe Token: SeSyncAgentPrivilege 3760 msiexec.exe Token: SeEnableDelegationPrivilege 3760 msiexec.exe Token: SeManageVolumePrivilege 3760 msiexec.exe Token: SeImpersonatePrivilege 3760 msiexec.exe Token: SeCreateGlobalPrivilege 3760 msiexec.exe Token: SeBackupPrivilege 3240 vssvc.exe Token: SeRestorePrivilege 3240 vssvc.exe Token: SeAuditPrivilege 3240 vssvc.exe Token: SeBackupPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeBackupPrivilege 452 srtasks.exe Token: SeRestorePrivilege 452 srtasks.exe Token: SeSecurityPrivilege 452 srtasks.exe Token: SeTakeOwnershipPrivilege 452 srtasks.exe Token: SeDebugPrivilege 208 keygenran.exe Token: SeBackupPrivilege 452 srtasks.exe Token: SeRestorePrivilege 452 srtasks.exe Token: SeSecurityPrivilege 452 srtasks.exe Token: SeTakeOwnershipPrivilege 452 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3760 msiexec.exe 3760 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3904 wrote to memory of 452 3904 msiexec.exe 99 PID 3904 wrote to memory of 452 3904 msiexec.exe 99 PID 3904 wrote to memory of 380 3904 msiexec.exe 101 PID 3904 wrote to memory of 380 3904 msiexec.exe 101 PID 3904 wrote to memory of 380 3904 msiexec.exe 101 PID 380 wrote to memory of 2808 380 MsiExec.exe 102 PID 380 wrote to memory of 2808 380 MsiExec.exe 102 PID 380 wrote to memory of 2808 380 MsiExec.exe 102 PID 380 wrote to memory of 4000 380 MsiExec.exe 104 PID 380 wrote to memory of 4000 380 MsiExec.exe 104 PID 380 wrote to memory of 4000 380 MsiExec.exe 104 PID 380 wrote to memory of 208 380 MsiExec.exe 106 PID 380 wrote to memory of 208 380 MsiExec.exe 106 PID 380 wrote to memory of 3016 380 MsiExec.exe 110 PID 380 wrote to memory of 3016 380 MsiExec.exe 110 PID 380 wrote to memory of 3016 380 MsiExec.exe 110 PID 380 wrote to memory of 1404 380 MsiExec.exe 112 PID 380 wrote to memory of 1404 380 MsiExec.exe 112 PID 380 wrote to memory of 1404 380 MsiExec.exe 112 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3760
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24199562090309F684CA7C6100DF6F532⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-08e4663e-d1f8-4a20-9db6-9805000ad7b6\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\MW-08e4663e-d1f8-4a20-9db6-9805000ad7b6\files\keygenran.exe"C:\Users\Admin\AppData\Local\Temp\MW-08e4663e-d1f8-4a20-9db6-9805000ad7b6\files\keygenran.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-08e4663e-d1f8-4a20-9db6-9805000ad7b6\files"3⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-08e4663e-d1f8-4a20-9db6-9805000ad7b6\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1404
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388KB
MD503fe272172afe473673575357d0e8cc8
SHA1c65ecd5f16f526782921ecb71643d51ef7304b81
SHA25680f11d6eb95e168459f46201e3aca4fee23bdeb2f7bb5ee710a7d4003f4517e1
SHA512b75b2f82454e3efd106616afa72eefddf00eb85aa3cb209774c1482432d92b65ce19a8bce403b2c5692df6a5fdf48e11cadb693656fc8012551caa2e4df3473a
-
Filesize
388KB
MD5d313cf4e6bf5e9dcb2ed3e722984bc8e
SHA121a28a94e0de60603ad1664a843717a8aeba30c9
SHA256739e1ab9e63ec4da436b2861c3c23111a823676896b6f2f40cf0051bf5c0e951
SHA5122a0d479f8b299370bb67ce34f4dfb58b52c70e7edcfa1f9cb6c40a6162455b77aad70bfd1f619dda327d969852eb1c20c7768f1c4247450740c203521f37ff34
-
Filesize
1KB
MD561d1528e399eb89e72980cddff96264d
SHA18993d60c6e0d6870b92b9d14505a0297fbf4c461
SHA2565b4ded9a0650917430f036646e76eb9f79a5ad5f40eb378e306f0825fe793e63
SHA512664f9a0eacbaa773a6df6dbda9cd68b75556f961f1c86c2c78a672bef1314e3c47c9c43cd7fa46aaf6696ea5fce350ac5fabf3cf23de91af28f1f4af6000cc55
-
Filesize
1KB
MD5c99a8c8a1c645812058498fbc9710637
SHA1c30ab1e492ab457cb8e42315a71425ace6aecead
SHA2563912eec61909983f9669d60a7010634b31d94680dc41a8fc8e656bbe3e5a3d02
SHA512ba70f4bc6efae22e85c5c8c0e812d757309a82ca94315460f8f7d66414e54a5d7bc713afa0ee3d46afd37136c5df3ec5fd97be2f620abd2ab57c6d26d87e6738
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
-
Filesize
24.1MB
MD59596c058ac3866971e7d10987f3b7965
SHA1d1fdcf1031bd790320ce4b0f5e4211d64822b88e
SHA256cb9b474a425875d3e35f735d00ddc22e80a1a7e247c1d436fef9e6210095b42a
SHA5129af2f5932d47c73f2677bba0fc496500c9674afe8a1580bf4a35f9bd395bbc16994ad3df6512db4ff5dda2964451c773b75e88ce567d519c8d525fd0ecb1a4b7
-
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b295c2b2-ca7c-4e74-a7d2-07a78355b007}_OnDiskSnapshotProp
Filesize6KB
MD54cf431aae8e1852c664fe472909a69cb
SHA17985398a687c358ff5b0b88e85f1ac50ae68cf63
SHA2561a044b4cc3884553a9db82160f83cd72da540c138aacc0862a071eec5a72f01d
SHA5124ee1a9ed0eff925a2eaa450a748c361c5b132901a6c32d542f0999afd312cb555c4fbb6e3847173ff006e08f590c74597ffd2f217283438a625d68903c087f6a