Resubmissions
16-03-2024 17:17
240316-vtswysfd2y 1016-03-2024 15:31
240316-syg9xafg39 1015-03-2024 08:15
240315-j5rmgsbg5z 10Analysis
-
max time kernel
437s -
max time network
447s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 17:17
General
-
Target
4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe
-
Size
29KB
-
MD5
9ca8e64065e6beaad07fc7b472c2617f
-
SHA1
0f91d62f996b0ec76addca130fb4f3b87e604d0f
-
SHA256
4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7
-
SHA512
e12b98a8111222f0bc918de5bd24ba2ef018fed28a3c81dd7775055142bd4e7ab29c62bfcde4a7d481caf8050dfb879d9df604d056fd50382015034cd30782f3
-
SSDEEP
384:BtWZPzzxAm1vwt9IryJS74WtRQ2bqlhlsNpGB0lFOy5o919rWXyw82vO:o7zxAmoIryJS1RQCqCN4uho9DriJ82m
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe"C:\Users\Admin\AppData\Local\Temp\4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-0-0x0000000000750000-0x000000000075E000-memory.dmpFilesize
56KB
-
memory/1336-1-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/1336-2-0x000000001B4A0000-0x000000001B4B0000-memory.dmpFilesize
64KB
-
memory/1336-3-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/1336-4-0x000000001B4A0000-0x000000001B4B0000-memory.dmpFilesize
64KB