Resubmissions

10-10-2021 08:37

211010-kh77dsffh5 10

10-10-2021 08:28

211010-kdbbvsfgck 10

Analysis

  • max time kernel
    80s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    10-10-2021 08:37

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2344-115-0x0000000000E30000-0x0000000000E31000-memory.dmp

    Filesize

    4KB

  • memory/2344-117-0x00000000014D0000-0x00000000014D2000-memory.dmp

    Filesize

    8KB

  • memory/2344-118-0x00000000014D2000-0x00000000014D4000-memory.dmp

    Filesize

    8KB

  • memory/2344-120-0x00000000014D5000-0x00000000014D7000-memory.dmp

    Filesize

    8KB

  • memory/2344-119-0x00000000014D4000-0x00000000014D5000-memory.dmp

    Filesize

    4KB