Overview

overview

10

Static

static

10

Yashma ran...1).exe

windows7-x64

10

Yashma ran...1).exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 20:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Yashma ransomware builder v1.2 (1).exe

  • Size

    825KB

  • MD5

    5120e2ada300c2eef255957dde5b84b0

  • SHA1

    dfb5c0b29fb235d34e851de234535474705be356

  • SHA256

    b24d58cd8d600431702b67fb815a92f465147553303c0f8a1867af77214dba75

  • SHA512

    958f089a7060188213dd00f6d73bbd625a89f98ccc0b5bf7b5963a3ef40677846e03a33866b79cec92fd29709ff8f0bd9a753397ef07f25779aedb02884d9f8c

  • SSDEEP

    6144:aMPUfX5X2onFLfFLzFL6FL6aGMVFLQ+FWD/:aLJX8QD

Score
10/10
chaospersistenceransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 58 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2 (1).exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\axhiyzgo\axhiyzgo.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25F2.tmp" "c:\Users\Admin\Downloads\CSC6CCAAC4783A545C8BB4A4D50CFF77E68.TMP"
        3⤵
          PID:3004
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3572
      • C:\Users\Admin\Downloads\dwdasd.exe
        "C:\Users\Admin\Downloads\dwdasd.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            • Suspicious use of FindShellTrayWindow
            PID:1184

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwdasd.exe.log
              Filesize

              660B

              MD5

              1c5e1d0ff3381486370760b0f2eb656b

              SHA1

              f9df6be8804ef611063f1ff277e323b1215372de

              SHA256

              f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a

              SHA512

              78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES25F2.tmp
              Filesize

              1KB

              MD5

              1fccc77a7bb6901daa473b8efc8ba87a

              SHA1

              f27368738f8d4a53788b3e869a2e43e912827c7a

              SHA256

              48f7f44e79f5de217cedd73373872a2bd96f9c36b17304f384824a0a30aca573

              SHA512

              8d44fd71c3c5c338d88a109605b8614b675a8bd7122b8855de0315554f1a8f4ddfdc4ca184142c6833cdd47fe937dd5a14e0ba35671ff8f5b4b1c9464c40ef1e

              Download Submit

            • C:\Users\Admin\AppData\Local\read_it.txt
              Filesize

              26B

              MD5

              a03b7362690865201624b579bb7674fb

              SHA1

              4875f8fea50b2fdfd5663ffc2ec3e5e1bbf8db74

              SHA256

              7f51e5aa90303d8195ec3babff979a6e1a29ecc003cfafce78ca0bdb716065d7

              SHA512

              2585e8347369a5199772ba8916e242ff1e0d94f21331127124775c91f16f8ad080fa1a8ee911fd97f9e163fdd0ba44833a0f6fdf3d23badd89d9c7acb5431644

              Download Submit

            • C:\Users\Admin\Downloads\dwdasd.exe
              Filesize

              26KB

              MD5

              38dd2e6836c05b23fe96ca2084a133fc

              SHA1

              fae5cc352474a60ee15eec36802247d1dd9dada0

              SHA256

              239451651bc7a3175f4e8611a623daa26cb8dc80c017b7a003886e410db69241

              SHA512

              3bc911441867d9d6ca45b50b5d32f8ade5d735c84bd809744adedbf2707d50a269da4a05432047a4fa4874a0d239afff233050ea1f8c15e0b81ef0d26b3642ca

              Download Submit

            • C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
              Filesize

              1B

              MD5

              d1457b72c3fb323a2671125aef3eab5d

              SHA1

              5bab61eb53176449e25c2c82f172b82cb13ffb9d

              SHA256

              8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

              SHA512

              ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\axhiyzgo\axhiyzgo.0.cs
              Filesize

              38KB

              MD5

              29c2201262d69d7e28fbc586a10dee65

              SHA1

              3af5c6d8c4d7277fd41044f17920a2d2d42f79ab

              SHA256

              3ccdaeb50a24eabf3022a1c9a0e398e32d0fcc18aa29cbb4371b832e99693a13

              SHA512

              7161ead08215e3d7031cbaac0889c5da1e6caeba38b813a8b91f665edf678043ae5f250953fe5690283f6f862fe54fa5a2cef598cbb0d3caa8339483f463cbfa

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\axhiyzgo\axhiyzgo.cmdline
              Filesize

              390B

              MD5

              4ce49f48ade7361ec306417a9169b743

              SHA1

              64aca3cbd8433ab00b018a30f86c86c2170a79c5

              SHA256

              b2380a72b7737d561e97546f0d6630fd04d2e012e597e1b0d714aff00926bde4

              SHA512

              2d715278c03bed8ac6084b96eb58407ab8acd250662df5af891fd4930242fc4f1727b4e85eba14833f957eb5ff95f6c7359d245e7b6fcf2e9fa3d4e6e2fa1abc

              Download Submit

            • \??\c:\Users\Admin\Downloads\CSC6CCAAC4783A545C8BB4A4D50CFF77E68.TMP
              Filesize

              1KB

              MD5

              425919f2384501d2b77d2d66d8358982

              SHA1

              8ca8e64584c9b6df9931318ff34b93a2c6afbc04

              SHA256

              b2df5f452f374e6381d7509cc620193a45c5d24f5368cc3aeea59906034f330d

              SHA512

              88129257fb998dbbee00ac8c0d246397c85fa9d1a29a0204b67a7a6c86f838c7f237ab686e765df7aa8ac214618c34a69d7a382a9489588c5c3238bfeef9ae42

              Download Submit

            • memory/3028-5-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-13-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-12-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-7-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-6-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-0-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

              Filesize

              8KB

              Download

            • memory/3028-4-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-3-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-2-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3028-1-0x0000026DF07A0000-0x0000026DF0874000-memory.dmp

              Filesize

              848KB

              Download

            • memory/3028-1299-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/5112-28-0x00000000004D0000-0x00000000004DC000-memory.dmp

              Filesize

              48KB

              Download