Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 19:31

General

  • Target

    SkynetLocker.exe

  • Size

    329KB

  • MD5

    75a95bd340c43bf016117c1013631c42

  • SHA1

    90a88828b3ed3c25bd91e20b67012f54e221ade6

  • SHA256

    b9cd15b5f4112728466f2c11d595711d0953da0d26408b57f42d1215cf60b1b1

  • SHA512

    41b4356df8be11a8a395918a8871f466c3b7e67ab1eaae1c40cfc374085302ca8693c463e8c24c143c362edde4c43442ddc52ae4ec96a4b4ad294caea17fcb62

  • SSDEEP

    6144:7cVbL0hiIOb8+LDCvzCnQHw67feMv8KiPuTL94:7cVJIOA+vCvnJ8tPuF4

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\SkynetData.txt

Ransom Note
------------------------ ALL YOUR FILES ARE ENCRYPTED ------------------------ Don't worry, you can return all your files! All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees do we give to you? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information Don't try to use third-party decrypt tools because it will destroy your files. Discount 50% available if you contact us first 24 hours. To get this software you need write on our e-mail: [email protected]

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 3 IoCs
  • Chaos family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SkynetLocker.exe
    "C:\Users\Admin\AppData\Local\Temp\SkynetLocker.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:2892
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1104
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:548
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1528
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\SkynetData.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1552
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3036
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1884
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:1992
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
        PID:1964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\SkynetData.txt

        Filesize

        809B

        MD5

        ca069420f1d43dabba1630a2477891c7

        SHA1

        ec68214b8909fe0098b91a68aa01fb269c5a147a

        SHA256

        6763e8a512a14afefd3bba63ef0516dbb378436e2bc7d853eaeb7a6fdf5eb090

        SHA512

        2054aa509f5f839677d654529a76ef84e05c5b34a81037c65ce14fba527c01516643b4b97ada26869197f6c8d63270b24fe7392263bbd705f0ef95c9ca498336

      • C:\Users\Admin\AppData\Roaming\svchost.exe

        Filesize

        329KB

        MD5

        75a95bd340c43bf016117c1013631c42

        SHA1

        90a88828b3ed3c25bd91e20b67012f54e221ade6

        SHA256

        b9cd15b5f4112728466f2c11d595711d0953da0d26408b57f42d1215cf60b1b1

        SHA512

        41b4356df8be11a8a395918a8871f466c3b7e67ab1eaae1c40cfc374085302ca8693c463e8c24c143c362edde4c43442ddc52ae4ec96a4b4ad294caea17fcb62

      • C:\Users\Admin\Desktop\SuspendSearch.tiff

        Filesize

        1B

        MD5

        d1457b72c3fb323a2671125aef3eab5d

        SHA1

        5bab61eb53176449e25c2c82f172b82cb13ffb9d

        SHA256

        8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

        SHA512

        ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

      • memory/2148-10-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

        Filesize

        9.9MB

      • memory/2148-8-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

        Filesize

        9.9MB

      • memory/2148-1-0x0000000001360000-0x00000000013B8000-memory.dmp

        Filesize

        352KB

      • memory/2148-0-0x000007FEF57A3000-0x000007FEF57A4000-memory.dmp

        Filesize

        4KB

      • memory/2376-11-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-9-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-7-0x0000000000F30000-0x0000000000F88000-memory.dmp

        Filesize

        352KB

      • memory/2376-708-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

        Filesize

        9.9MB