Resubmissions
23/03/2025, 02:38
250323-c4ywva1l17 1010/03/2025, 05:32
250310-f8b5esvjv5 1007/11/2024, 02:24
241107-cvwp5atepk 1006/11/2024, 12:51
241106-p3t8gszhkf 10Analysis
-
max time kernel
38s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 02:38
Behavioral task
behavioral1
Sample
wt.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
wt.exe
Resource
win10v2004-20250314-en
General
-
Target
wt.exe
-
Size
23KB
-
MD5
9cbcaed1a71dca5fa2fcb5fe41e0d083
-
SHA1
699923b980e8b8677ab29137dec889cb4c7a87da
-
SHA256
4a99edc4912bb72864cf424c67b500187079ffb5bee14d6851800ebff9a56808
-
SHA512
bab13f8992a4c692412e0e15567693df36d02e6bf986bbadf9c4ff5b285b57853c6a9eafc3250cd1bdf33977428ddfa6c783080d1430e5593a181add28f19f2f
-
SSDEEP
384:I3Mg/bqo2f+B3kXSP1/pYVvobPJ/r91C9zBq92BewD9:2qo2gtxpjh/r9uzs9WewD9
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/2068-1-0x0000000000410000-0x000000000041C000-memory.dmp family_chaos behavioral2/files/0x000800000002428a-6.dat family_chaos -
Chaos family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation wt.exe Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 6 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\svchost.url taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.oypr taskmgr.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\read_it.txt taskmgr.exe -
Executes dropped EXE 1 IoCs
pid Process 2136 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-308834014-1004923324-1191300197-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 868 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2136 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2068 wt.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2068 wt.exe Token: SeDebugPrivilege 2136 svchost.exe Token: SeDebugPrivilege 1376 taskmgr.exe Token: SeSystemProfilePrivilege 1376 taskmgr.exe Token: SeCreateGlobalPrivilege 1376 taskmgr.exe Token: 33 1376 taskmgr.exe Token: SeIncBasePriorityPrivilege 1376 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe 1376 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2136 2068 wt.exe 95 PID 2068 wrote to memory of 2136 2068 wt.exe 95 PID 2136 wrote to memory of 868 2136 svchost.exe 99 PID 2136 wrote to memory of 868 2136 svchost.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\wt.exe"C:\Users\Admin\AppData\Local\Temp\wt.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:868
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436B
MD53d3e96607027344d061753478fea083a
SHA1593e6782619f9f75e9c7dd83cfa2d72fb5ad31bf
SHA2569a2289099c885381950980ce382994d2afde209bd31a02ff5b378aa8dd201f9a
SHA512ca6ffbc8fab609c2b9634a2a54c8e5506a16aa2462d266c09be25d6a7a3a846d117f0495b4b65d7142ab6963bb52fb766ba593ecc49efe46f42fd5735bbc2ca3
-
Filesize
142B
MD51a09a38485cbf1d59c29d8e3213e1ab9
SHA19cbe6ebd07b13a0d4b2565dc15a273629aa97251
SHA2560a3bdc40dc0d243784bc5fa887b79110350b3d3200684f3ba99880fcea40e3b8
SHA512a33c228196a4b3f14e40ac6ccb6c43002de28063594c472db852bedac20a6725f4e7601b9f32516e2c6bea35f83746973b3f1d200d9e5d668bda7553b62ac616
-
Filesize
23KB
MD59cbcaed1a71dca5fa2fcb5fe41e0d083
SHA1699923b980e8b8677ab29137dec889cb4c7a87da
SHA2564a99edc4912bb72864cf424c67b500187079ffb5bee14d6851800ebff9a56808
SHA512bab13f8992a4c692412e0e15567693df36d02e6bf986bbadf9c4ff5b285b57853c6a9eafc3250cd1bdf33977428ddfa6c783080d1430e5593a181add28f19f2f
-
Filesize
1KB
MD5691dabf88ce8bf585b6554d8f0ff880e
SHA1543414f88078a7a5520593e24119253f2b7fc95c
SHA256c58ae5db59068e59c319fd721a3d0d9174fdca70ad1e37859970dfabc0de49b2
SHA5120017de1d0780f6f33d8ea630ef2ca1bdc6b8836cea78647cd640f0e0dbc84108cae2e2b46ea03c14fe0bec48010fc1b437c1019f99d63ad60dc99108dfe58f8f