Overview

overview

10

Static

static

10

Yashma ran....2.exe

windows7-x64

10

Yashma ran....2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Yashma ransomware builder v1.2.exe

  • Size

    826KB

  • MD5

    20a7eea3f65edd41df1e3bbce7d2b674

  • SHA1

    44a9d957a24ab0e9f2066e9dfc4da8f9d46f0025

  • SHA256

    e505fe2a77857ac94c657999533631289dc76a1c62c73169232dfcd7a25990a9

  • SHA512

    bf3189616f1ed3ca3059fdbb9ea72c38a2e32804b0c5919f058d0798b928c4fd1ce3d015a4366c3f689bcfaa10d2f1fcd3a169c9e3ec6a68f4abdc47ef386fb0

  • SSDEEP

    6144:pMPUfXnG2omFLhFLuFL6FL6aGMVFLQYFWD/:pL3GcQZ

Score
10/10
chaospersistenceransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 56 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe
    "C:\Users\Admin\AppData\Local\Temp\Yashma ransomware builder v1.2.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eclgugdc\eclgugdc.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20E1.tmp" "c:\Users\Admin\Desktop\CSCE191182B43114A7CBE1B3DB8D7BE8DB1.TMP"
        3⤵
          PID:1444
    • C:\Users\Admin\Desktop\nignog.exe
      "C:\Users\Admin\Desktop\nignog.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:4520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nignog.exe.log
      Filesize

      660B

      MD5

      1c5e1d0ff3381486370760b0f2eb656b

      SHA1

      f9df6be8804ef611063f1ff277e323b1215372de

      SHA256

      f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a

      SHA512

      78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RES20E1.tmp
      Filesize

      1KB

      MD5

      ed2bcd67f01cece1b22ce498e09f242d

      SHA1

      a1fb4e0ee49a16cc2af7bb5a350b058e0f59cfa1

      SHA256

      a8abce9693da322bd58a351fedd93e32b502398d186fe5b7d2d9ce94864f85fe

      SHA512

      80c54ac3eebfc9f82688f5b0f1350c15b5aed0b306be819613a89a84a37ac9284870ac6108adec382f2f585936578069268cfefa3d01de901aa53ea09f2af8c7

      Download Submit

    • C:\Users\Admin\AppData\Local\read_it.txt
      Filesize

      545B

      MD5

      4e1993884856220831094e32752cc523

      SHA1

      b69a2d07fab91e6f0ec1215579aa94bd6c0b82e8

      SHA256

      e0c71e46f0573d3cce826cbbf67dc2552db72e8b4cd56636645ad0c5c54923f7

      SHA512

      2f5403bdd9b2fab06109cfddcc77df4be45c30f30d24879a303858eddcdb86b9de5b1f46907cdf04db577c4f35380d7003de42b93e349dfc6cd53f66a3dc4959

      Download Submit

    • C:\Users\Admin\Desktop\BackupRepair.avi
      Filesize

      1B

      MD5

      d1457b72c3fb323a2671125aef3eab5d

      SHA1

      5bab61eb53176449e25c2c82f172b82cb13ffb9d

      SHA256

      8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

      SHA512

      ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

      Download Submit

    • C:\Users\Admin\Desktop\nignog.exe
      Filesize

      27KB

      MD5

      5f1295daf1dbfff63f56a28ca182d9c2

      SHA1

      8f9c6e891400e0b615cbb14c56e323e96c2c91ea

      SHA256

      f13213d4703284d31a921ed5bdae7bf5c8d87ca97f551aef9fbca75616912600

      SHA512

      3fa3fb648a4907ec08638ad6a10223aa377462f3684f0e92ffced35f3356db24a13cbe6b03bdc0c12dc44c73a78538a211cf0dfa86548318400ec32975d65920

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\eclgugdc\eclgugdc.0.cs
      Filesize

      38KB

      MD5

      150fecfcdef91402c9a7afc16dfe1f79

      SHA1

      79a6033a585299216d15b73f2e8e94a74eec9f0b

      SHA256

      aba76585c443663e5df0acc1dfbc9631274756478d1547a069f2f01b2b501c39

      SHA512

      fae40a6913d68163ace78e785d75ebd918f59e856c9477171b69f066d60f2a3e229935a23bdad0a0194a277c99dcffe6c89601dd0d40446d3a93d03434a9b6b6

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\eclgugdc\eclgugdc.cmdline
      Filesize

      388B

      MD5

      aab3048c8e005738915ddc6b83462eb7

      SHA1

      2999bdd1ddd4cc42844b76571c92bf0134527403

      SHA256

      f91c070bf8e43906cfd61e726e5c624a2767b42d51c34e30b5c2456d022fa791

      SHA512

      461cac8a383cee20b904991a93bdc28103015f6ef7e1ae51d32714c80dc5be4b31f817c9cb2a55fb9bd22ff051e669b4851b4ebda46b844b620e6ffe250bae94

      Download Submit

    • \??\c:\Users\Admin\Desktop\CSCE191182B43114A7CBE1B3DB8D7BE8DB1.TMP
      Filesize

      1KB

      MD5

      fa6f111c77a8990a5c10a3ff5f4be55c

      SHA1

      9e173d8f91946c09827cc121929e80b825de1bcb

      SHA256

      6b2566f58e84cdb35b34c89cf94fdc330a00ebea5f542ceef3cfedd91e9a8e85

      SHA512

      6953eb18d4d158ede3cc3ca72a5744fe4d72122da34e0b23f29cdbec5eed5cf3eb406dc1088488d0ba605702bb6e21702675e30525cdbde75792ea689dad0aab

      Download Submit

    • memory/2372-29-0x0000000000F20000-0x0000000000F2E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2672-5-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-14-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-13-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-8-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-7-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-6-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2672-4-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2672-3-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-2-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2672-1-0x000001C3FAD80000-0x000001C3FAE54000-memory.dmp

      Filesize

      848KB

      Download