Overview

overview

10

Static

static

10

34c392448f...ea.exe

windows7-x64

10

34c392448f...ea.exe

windows7-x64

10

34c392448f...ea.exe

windows10-2004-x64

10

34c392448f...ea.exe

windows10-ltsc_2021-x64

10

34c392448f...ea.exe

windows11-21h2-x64

10

37d8add251...4c.exe

windows10-2004-x64

8

37d8add251...4c.exe

windows7-x64

10

37d8add251...4c.exe

windows10-2004-x64

8

37d8add251...4c.exe

windows10-ltsc_2021-x64

8

37d8add251...4c.exe

windows11-21h2-x64

8

3a72653053...59.exe

windows11-21h2-x64

10

3a72653053...59.exe

windows7-x64

10

3a72653053...59.exe

windows10-2004-x64

10

3a72653053...59.exe

windows10-ltsc_2021-x64

10

3a72653053...59.exe

windows11-21h2-x64

10

49aca08f5b...24.exe

windows11-21h2-x64

10

49aca08f5b...24.exe

windows7-x64

10

49aca08f5b...24.exe

windows10-2004-x64

10

49aca08f5b...24.exe

windows10-ltsc_2021-x64

10

49aca08f5b...24.exe

windows11-21h2-x64

10

4a2ad49c93...9f.exe

windows10-2004-x64

3

4a2ad49c93...9f.exe

windows7-x64

3

4a2ad49c93...9f.exe

windows10-2004-x64

3

4a2ad49c93...9f.exe

windows10-ltsc_2021-x64

3

4a2ad49c93...9f.exe

windows11-21h2-x64

3

5199b64b50...3c.exe

windows7-x64

5199b64b50...3c.exe

windows7-x64

5199b64b50...3c.exe

windows10-2004-x64

5199b64b50...3c.exe

windows10-ltsc_2021-x64

5199b64b50...3c.exe

windows11-21h2-x64

1

Resubmissions

25/03/2025, 13:12 UTC

250325-qfl42aznw9 10

25/03/2025, 13:09 UTC

250325-qdtq4aznv6 10

25/03/2025, 13:05 UTC

250325-qbtcjszns3 10

25/03/2025, 13:01 UTC

250325-p9k86awxat 10

25/03/2025, 12:55 UTC

250325-p58tnawwe1 10

25/03/2025, 12:51 UTC

250325-p3txqazmt6 10

05/02/2025, 11:16 UTC

250205-ndjvsavrdm 10

16/07/2024, 08:54 UTC

240716-kt64gavakp 10

Analysis

  • max time kernel
    90s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2025, 12:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe

  • Size

    44KB

  • MD5

    7977bc8781a00875b4d465bc2a90d5d4

  • SHA1

    9f4b2858edcff694fee76636bf8cf33a366fc237

  • SHA256

    49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24

  • SHA512

    245d65b9301b759097cded2a2f078e4e41c7b68e303a71fccd465a6fa230b48e13e571c4e57e03710934a5e6b9536ed634e0edc502ba35433b02147760e5f05b

  • SSDEEP

    768:0AxEin+Z8W9KCZLhaY4m9lUOmMayPpfHlynRUhMgAA9dEmCJ:7xESW9KC1hxJ9lJPQLH

Score
10/10
chaosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\لفك تشفير ملفات اضغط هنا

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back? Contact me to decrypt your files : https://t.me/+aZZ3tv3FBVM5ODk8
URLs

https://t.me/+aZZ3tv3FBVM5ODk8

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe
    C:\Users\Admin\AppData\Local\Temp\49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe bcdedit /set shutdown /r /f /t 2
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Roaming\windowsdefender.exe
      "C:\Users\Admin\AppData\Roaming\windowsdefender.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5980
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5868
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:232
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3812
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4924
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:5792
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:3636
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:412
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4412
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:4712
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:5440
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3796

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Indicator Removal

    3
    T1070

    File Deletion

    3
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    4
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\2012_x64_1_vcRuntimeAdditional_x64.log
      Filesize

      1B

      MD5

      d1457b72c3fb323a2671125aef3eab5d

      SHA1

      5bab61eb53176449e25c2c82f172b82cb13ffb9d

      SHA256

      8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

      SHA512

      ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe.log
      Filesize

      226B

      MD5

      4ae344179932dc8e2c6fe2079f9753ef

      SHA1

      60eacc624412b1f34809780769e3b212f138ea9c

      SHA256

      3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4

      SHA512

      fadfe2b83f1af8fdc50430325f69d6172d2c1e889ca3800b3b83e5535d5970c32e9a176b48563275a0630d56c96d9f88df148fd6b2d281f0fc58129e5f4dba19

      Download Submit

    • C:\Users\Admin\AppData\Roaming\windowsdefender.exe
      Filesize

      44KB

      MD5

      7977bc8781a00875b4d465bc2a90d5d4

      SHA1

      9f4b2858edcff694fee76636bf8cf33a366fc237

      SHA256

      49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24

      SHA512

      245d65b9301b759097cded2a2f078e4e41c7b68e303a71fccd465a6fa230b48e13e571c4e57e03710934a5e6b9536ed634e0edc502ba35433b02147760e5f05b

      Download Submit

    • C:\Users\لفك تشفير ملفات اضغط هنا
      Filesize

      377B

      MD5

      3b8d73c95c31911b53b39895d1c2a588

      SHA1

      ca48d939e174ec33f27af1cb821517be10ac1b02

      SHA256

      4e258e6c04d087af311791d39279e6dc5656418e7dcdc08825a7356d0cfef5e8

      SHA512

      1ceadb0c5a49939346ebb782edb520c2e4d36c56be866495a51cedc1a02c216d9f005f430c4085855564331c715262c01a55296460f096f0927436595c879acb

      Download Submit

    • memory/2064-0-0x00007FFF0C573000-0x00007FFF0C575000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2064-1-0x0000000000380000-0x0000000000392000-memory.dmp

      Filesize

      72KB

      Download

    • memory/5980-14-0x00007FFF0C570000-0x00007FFF0D032000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5980-53-0x00007FFF0C570000-0x00007FFF0D032000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5980-1410-0x00007FFF0C570000-0x00007FFF0D032000-memory.dmp

      Filesize

      10.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.