Overview

overview

10

Static

static

10

2dd3144ab2...b4.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    160s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-01-2025 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4.exe

  • Size

    6.3MB

  • MD5

    95be77dac172c472cba318f9876ec444

  • SHA1

    e24fc0a73ff5675a33de6bf033b65fa4b139d85a

  • SHA256

    2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4

  • SHA512

    4eeefdd69073f33d7369e52a306e812178365322ce26573331c9bfe9b60935e87b1a10b754df7159d87f1767ac945183b178923a53e21b7a5808e31e2af5a0a0

  • SSDEEP

    49152:31WDsGsL5TCvRc46CCGZuoKzzkvhctESbe7t0G8IfPIu3GTJ:

Score
10/10
chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\read_it.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important files have been encrypted with military-grade encryption. What guarantees do we give you? You can send 3 of your encrypted files and we will decrypt them for free. You must follow these steps to decrypt your files: 1) Write on our telegram: @RansowHacking 2) Get Bitcoin (you must pay for decryption in any cryptocurrency below: After paying the amount of 500usdt, we will send you the tool that will decrypt all your files.) BTC: bc1qngsfpztnqlvs2jktxdkh53j5mgrty3s003tas5 ETH: 0x75427fC1b7830528748F914951bBF1D6403d072e XMR: 0x082b5a11e1c727F6be2A4a3c1028cD6797370786 TRC20: TB5nxv8hUKRvpfeHjgnNaCEbwXfja73gMb ============================ {PT-BT}============================== Não se preocupe, você pode devolver todos os seus arquivos! Todos os seus arquivos como documentos, fotos, bancos de dados e outros arquivos importantes foram criptografados com uma criptografia de nivel militar. Que garantias lhe damos? Você pode enviar 3 de seus arquivos criptografados e nós os descriptografamos gratuitamente. Você deve seguir estas etapas para descriptografar seus arquivos: 1) Escreva em nosso telegram: @RansowHacking 2) Obtenha Bitcoin (você deve pagar pela descriptografia em qualquer criptomoeda abaixo: Após o pagamento do valor de 500usdt, enviaremos a você a ferramenta que irá descriptografar todos os seus arquivos.) BTC: bc1qngsfpztnqlvs2jktxdkh53j5mgrty3s003tas5 ETH: 0x75427fC1b7830528748F914951bBF1D6403d072e XMR: 0x082b5a11e1c727F6be2A4a3c1028cD6797370786 TRC20: TB5nxv8hUKRvpfeHjgnNaCEbwXfja73gMb

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (184) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 6 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1064
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3368
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4888
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2872
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4676
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:4144
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:476
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1560
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:3436
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:632
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\read_it.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:5304
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\test.docx" /o ""
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5124
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
        PID:7108
      • C:\Windows\system32\BackgroundTransferHost.exe
        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
        1⤵
        • Modifies registry class
        PID:2952
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4876
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\read_it.txt
          1⤵
            PID:6752
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4388

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Indicator Removal

          3
          T1070

          File Deletion

          3
          T1070.004

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Defacement

          1
          T1491

          Inhibit System Recovery

          4
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\read_it.txt
            Filesize

            1KB

            MD5

            3e2b5192e7ca51e0bd3fe0910b680ee6

            SHA1

            a0a124d65a22f6f614dedc8cc9c35da9ac54c598

            SHA256

            897da642f47d00bc703e62b3e9d451ab24af1ec742dfe739c924a02a56988c61

            SHA512

            ee7326f3dabff32ebaaa7285b23ea2ec3a7753e7e8a255a81fe8f957083f016482b6beeb4468da00e1ab1ceed209a4b37bbc07ea7ba3f5046a2f5d7434d3db24

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4.exe.log
            Filesize

            1KB

            MD5

            b4e91d2e5f40d5e2586a86cf3bb4df24

            SHA1

            31920b3a41aa4400d4a0230a7622848789b38672

            SHA256

            5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

            SHA512

            968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3b42b1f6-d88a-427a-addf-aa0ba9c4e280.down_data
            Filesize

            555KB

            MD5

            5683c0028832cae4ef93ca39c8ac5029

            SHA1

            248755e4e1db552e0b6f8651b04ca6d1b31a86fb

            SHA256

            855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

            SHA512

            aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
            Filesize

            9KB

            MD5

            308f442be583c1644f2ea51fe2e6b2f0

            SHA1

            98a69f54a39ed1111656b1dc2e1faa175c7902b6

            SHA256

            e3a5e3c6fea79f1d605a72cf39df89c34e09701b3cee463be98d06fae4907ac3

            SHA512

            a52f4c547fab0f1eb7e8528d80cbe9b4c8fd5c1035c7a9ed2345d58017f3fca2287cb00fdc5d1ae35da08b990703ba3fcce668781d95250da0e233e755df98de

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
            Filesize

            9KB

            MD5

            8b1cd8fd9bf7f7f7178eaca4edfcf0b4

            SHA1

            24015886885f8a2b6301e7f013935473a6b6544c

            SHA256

            324cdb1d7dc50fd6793c63ed4992b0aef2c58e3683e3fff8010e887042edfb6f

            SHA512

            c0913f5f4eb448bf3977946352bd92807de535d78267fc9642476e0a8ca004edd92cf53ab371f1cc5f2064ac8764dae2b1f7bac73f0bfb9ce7efe30755e4bc44

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
            Filesize

            53B

            MD5

            1ca6e340fc3f8fd036071c0d7cc12907

            SHA1

            9e6db723bf50b08c4d1c168e6e88d6fbe79a7cd1

            SHA256

            a1a301b4de6177f76eed0ee9dfa8875067ec43640114ededf0a2fe910811df1d

            SHA512

            d4e52539df8fdc617657cefab62e78a62d211d79c36ccfd9c8f8d7a38aeb2bcb1c7d7452930cd9fcfb7c497372a145a2027b6f60911b6abf1042ed711b3c4798

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\test.docx.LNK
            Filesize

            495B

            MD5

            05773d1d296e3bb8a643c0a05bed83ca

            SHA1

            1d74fed341b5d2ba8ffb9dd0398af5a04cd40149

            SHA256

            e97f69267ca6d8a9f0294336fa46768ce70fe7723c02892c00672cbfd379e452

            SHA512

            8a88719892c02e44e3995b2d74f90f6befaf1aeb4501022c87dee6f3c3992e0a0bff09c6f5366baa759699dadf88982d0bfc294f23f476d32be3cc82db11d059

            Download Submit

          • C:\Users\Admin\AppData\Roaming\svchost.exe
            Filesize

            6.3MB

            MD5

            95be77dac172c472cba318f9876ec444

            SHA1

            e24fc0a73ff5675a33de6bf033b65fa4b139d85a

            SHA256

            2dd3144ab294d675eae0290d5b2d385d4d7ddb36e0450b982358a1519ba19fb4

            SHA512

            4eeefdd69073f33d7369e52a306e812178365322ce26573331c9bfe9b60935e87b1a10b754df7159d87f1767ac945183b178923a53e21b7a5808e31e2af5a0a0

            Download Submit

          • C:\Users\Admin\Desktop\~WRD0000.tmp
            Filesize

            11KB

            MD5

            ffd45acd591bfcad58ed8026bb2d3068

            SHA1

            985d9ab6dc84d38594ab4ba668377a42f8db2977

            SHA256

            fed7d5dc4436054f5e8fe5434acc01c0f32d05855141b5e053a599171bb72399

            SHA512

            48a1faa22b81daf5886d868905ff4a72c0e7dbe5b7c59f4160436941a55eeba07eff208fa6d8ad58ebe7a2d2ea3da574ed4b27c51f39d1ac76e9f5860d853013

            Download Submit

          • C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk
            Filesize

            1B

            MD5

            d1457b72c3fb323a2671125aef3eab5d

            SHA1

            5bab61eb53176449e25c2c82f172b82cb13ffb9d

            SHA256

            8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

            SHA512

            ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

            Download Submit

          • memory/936-16-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/936-1-0x0000000000D00000-0x0000000001352000-memory.dmp

            Filesize

            6.3MB

            Download

          • memory/936-2-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/936-0-0x00007FFF71D23000-0x00007FFF71D25000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2640-15-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2640-1203-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/5124-1206-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1212-0x00007FFF3EEB0000-0x00007FFF3EEC0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1211-0x00007FFF3EEB0000-0x00007FFF3EEC0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1209-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1314-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1317-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1316-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1315-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1208-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1207-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/5124-1205-0x00007FFF41990000-0x00007FFF419A0000-memory.dmp

            Filesize

            64KB

            Download