Analysis
- max time kernel
26s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 17:34
General
- Target 0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe
- Size 163KB
- Sample261011-v5hkcsvsc1
- SHA256 0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a
Malware Config
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Renames multiple (127) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 14 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 63 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe"C:\Users\Admin\AppData\Local\Temp\0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\HOW TO DECRYPT FILES.txt3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
explorer.exe
HOW TO DECRYPT FILES.txt
CheckpointResume.rtf
ClearEdit.dib
memory/1796-8-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-11-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-6-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-7-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-0-0x0000000000B80000-0x0000000000BA2000-memory.dmp
memory/1796-9-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-10-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-5-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-12-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-13-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-4-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-1-0x00007FFD973EF000-0x00007FFD973F0000-memory.dmp
memory/1796-2-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-3-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1796-18-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-19-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-20-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-30-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-17-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-16-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-15-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-472-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-473-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-474-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-481-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-504-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-511-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-512-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/4268-1067-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp