Overview

overview

10

Static

static

10

989.exe

windows10-2004-x64

7

989.exe

windows11-ltsc_2024-x64

6

Annoying-r...er.exe

debian-12-armhf

1

AnotherTest.exe

windows10-2004-x64

3

AnotherTest.exe

windows11-ltsc_2024-x64

3

BEASTY.exe

windows10-2004-x64

BEASTY.exe

windows11-ltsc_2024-x64

5

CO2.exe

windows10-2004-x64

8

CO2.exe

windows11-ltsc_2024-x64

8

Claridonium.exe

windows10-2004-x64

3

Claridonium.exe

windows11-ltsc_2024-x64

3

Crypto$ucker.exe

windows10-2004-x64

7

Crypto$ucker.exe

windows11-ltsc_2024-x64

7

DCQPKX (2).exe

windows10-2004-x64

DCQPKX (2).exe

windows11-ltsc_2024-x64

FullMemory.exe

windows10-2004-x64

3

FullMemory.exe

windows11-ltsc_2024-x64

3

Gayware.py

windows10-2004-x64

3

Gayware.py

windows11-ltsc_2024-x64

3

HYDRA.exe

windows10-2004-x64

3

HYDRA.exe

windows11-ltsc_2024-x64

3

JVXB_Destructive.exe

windows10-2004-x64

6

JVXB_Destructive.exe

windows11-ltsc_2024-x64

6

MBRNOOTER.exe

windows10-2004-x64

MBRNOOTER.exe

windows11-ltsc_2024-x64

MadLocker.exe

windows10-2004-x64

3

MadLocker.exe

windows11-ltsc_2024-x64

3

Magellan.exe

windows10-2004-x64

Magellan.exe

windows11-ltsc_2024-x64

7

Malware.exe.py

windows10-2004-x64

3

Malware.exe.py

windows11-ltsc_2024-x64

3

Money.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Some cracks and nifty things.zip
  • Size 16.5MB
  • Sample260915-da8dvsbn8z
  • SHA256 04e5656c04649b9880a2b3cc64dddba721a9598e337944ed90b17437ea92912f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
chaoshavocbackdoorbootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerransomwareupx

Malware Config

Extracted

Family

  • havoc

C2

  • 192.168.192.129

Attributes
  • spawn

    C:\Windows\System32\notepad.exe

    C:\Windows\SysWOW64\notepad.exe

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Targets

    • Target
      989.exe
    • Size 78KB
    • SHA256 de565c1a5219ba854e5c34b1634603fe0f617cced7e54c0cea5c8b84d1cb535f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecutionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral1behavioral2
    • Target
      Annoying-randoizer.exe
    • Size 8KB
    • SHA256 330bcd0ac6582e9a2dcc6da190da3dc2f7aa111889f8e078ef796614373bf485
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      AnotherTest.exe
    • Size 832KB
    • SHA256 7470c387361448eb9884f4bf45c3ba24bc7eed061dce05c369fad1e419e69fb6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4behavioral5
    • Target
      BEASTY.exe
    • Size 24KB
    • SHA256 fca5992f7d3ec6da4095bd4d02da097d8ac3372f298a26e736b88567f6244e72
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationupx

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral6behavioral7
    • Target
      CO2.exe
    • Size 12KB
    • SHA256 27bb600cb31866cb2dd56f4807064f80cbb7be2421da9923f72fbe401d942210
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscovery
    behavioral8behavioral9
    • Target
      Claridonium.exe
    • Size 113KB
    • SHA256 6dd7aa9b0f8444bdddcc3e888cf75a800a9bb22bb776ffa1d8ce69880815766d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral11
    • Target
      Crypto$ucker.exe
    • Size 4.5MB
    • SHA256 b96d49e2e30c976c9bc4629ed62a44474fc68f6e27de710ca448bbcfd858d5f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral12behavioral13
    • Target
      DCQPKX (2).exe
    • Size 15KB
    • SHA256 20de244689a259865cc608a4a11b1e34afe71ab7051e1bb36c095ee0afc31e09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14behavioral15
    • Target
      FullMemory.exe
    • Size 39KB
    • SHA256 a489e7dc06ba4ef9572b66acfecf89c62d6b5c3d35b0ecb216aee2a4cd475498
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral16behavioral17
    • Target
      Gayware.py
    • Size 1KB
    • SHA256 a52902b8228d79ae0ced95f08324d89680714189c57170399d24fdefd8944d7a
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral18behavioral19
    • Target
      HYDRA.exe
    • Size 179KB
    • SHA256 5e36fc30f3cf95d9423598d6362564d030335558f06fedc82c9e62899532a1cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral20behavioral21
    • Target
      JVXB_Destructive.exe
    • Size 112KB
    • SHA256 b68dfbca704824677abc4e1ed9138de1cedc4a55348792cf7c79e05422b82dd2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral22behavioral23
    • Target
      MBRNOOTER.exe
    • Size 150KB
    • SHA256 c494c4a9982d9a9ff134cc78680654841a36fc2fe7bf384c77c081be013075cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoveryexecutionpersistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral24behavioral25
    • Target
      MadLocker.exe
    • Size 61KB
    • SHA256 fcc4abe7e1fbd198ba67d74c0c7e367c1a80e43af50ad17dd28179e3855c9734
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral26behavioral27
    • Target
      Magellan.exe
    • Size 167KB
    • SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecutionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral28behavioral29
    • Target
      Malware.exe.py
    • Size 1KB
    • SHA256 3a809c96943ac96d183ef716071b6366a224987eb84a732c239bc3f100b13a59
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral30behavioral31
    • Target
      Money.exe
    • Size 100KB
    • SHA256 c78a4f88b376d8ce9586f536980c25b1bef6a1abcd3dfa4b3ca6aa82588a241d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upxpyinstallerbackdoorhavocransomwarechaos
Score
10/10

behavioral1

discoveryexecutionpersistence
Score
7/10

behavioral2

discoveryexecutionpersistence
Score
6/10

behavioral3

Score
1/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discoverypersistenceprivilege_escalationupx
Score
7/10

behavioral7

discoveryupx
Score
5/10

behavioral8

defense_evasiondiscovery
Score
8/10

behavioral9

defense_evasiondiscovery
Score
8/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
7/10

behavioral13

discovery
Score
7/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

bootkitpersistence
Score
6/10

behavioral23

bootkitpersistence
Score
6/10

behavioral24

bootkitdiscoveryexecutionpersistence
Score
6/10

behavioral25

bootkitdiscoveryexecutionpersistence
Score
6/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discoveryexecutionpersistence
Score
7/10

behavioral29

discoveryexecutionpersistence
Score
7/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

Score
1/10