Resubmissions
16-03-2024 17:17
240316-vtswysfd2y 1016-03-2024 15:31
240316-syg9xafg39 1015-03-2024 08:15
240315-j5rmgsbg5z 10Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 08:15
General
-
Target
4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe
-
Size
29KB
-
MD5
9ca8e64065e6beaad07fc7b472c2617f
-
SHA1
0f91d62f996b0ec76addca130fb4f3b87e604d0f
-
SHA256
4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7
-
SHA512
e12b98a8111222f0bc918de5bd24ba2ef018fed28a3c81dd7775055142bd4e7ab29c62bfcde4a7d481caf8050dfb879d9df604d056fd50382015034cd30782f3
-
SSDEEP
384:BtWZPzzxAm1vwt9IryJS74WtRQ2bqlhlsNpGB0lFOy5o919rWXyw82vO:o7zxAmoIryJS1RQCqCN4uho9DriJ82m
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe"C:\Users\Admin\AppData\Local\Temp\4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2372-0-0x0000000001230000-0x000000000123E000-memory.dmpFilesize
56KB
-
memory/2372-1-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmpFilesize
9.9MB
-
memory/2372-2-0x0000000001040000-0x00000000010C0000-memory.dmpFilesize
512KB
-
memory/2372-3-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmpFilesize
9.9MB
-
memory/2372-4-0x0000000001040000-0x00000000010C0000-memory.dmpFilesize
512KB