chaos

Sharing

Copy URL

Twitter E-mail

General

Target

X2 2021 2023 Official.zip
Size

6.5MB
Sample

240404-zbec3aac85
MD5

99a840453e609bbf175c3b694e04a19f
SHA1

4eda2014186b158710253e5a40ed8924f31fa406
SHA256

09e3df6d0af19553c48a891bc78cfbf269f7ae13c9490abc975ce33f18699313
SHA512

7ce0c499b7fed9ad7084c684300b38e3065bf47ac295115c8eaf24bf2f44cdc47f46f8b9be30ab8d239644e574b095f8601f8756d868076d63c6311a1c2da34c
SSDEEP

196608:lD7ZkLrDnSf8LmVYwcdBmvUb87DkeW/FfYFqaQe6OrslFux:FOrzE8LuYwL8bIkeW/FQqpqryFux

Score

10^/10

Malware Config

Targets

- Target
  
  X2 2021 2023 Official.zip
- Size
  
  6.5MB
- MD5
  
  99a840453e609bbf175c3b694e04a19f
- SHA1
  
  4eda2014186b158710253e5a40ed8924f31fa406
- SHA256
  
  09e3df6d0af19553c48a891bc78cfbf269f7ae13c9490abc975ce33f18699313
- SHA512
  
  7ce0c499b7fed9ad7084c684300b38e3065bf47ac295115c8eaf24bf2f44cdc47f46f8b9be30ab8d239644e574b095f8601f8756d868076d63c6311a1c2da34c
- SSDEEP
  
  196608:lD7ZkLrDnSf8LmVYwcdBmvUb87DkeW/FfYFqaQe6OrslFux:FOrzE8LuYwL8bIkeW/FQqpqryFux
Score

1^/10
behavioral1
- Target
  
  X2 2021 Official/Bin.db
- Size
  
  7KB
- MD5
  
  afd813046d7206ad230e0710ff162511
- SHA1
  
  282d1ebd765ddd1a46ac784540c2caca380c7a1c
- SHA256
  
  7eb36b44697a52c3b987a62e0f9135e3b8c0e2a9224a6ab61bfcc3d1d4e26f1a
- SHA512
  
  d844719be47b98a559dcf18732d6eb9af33a6c41e14d973133716f65e0ff187d78df076462c9f8567f3e35d37e720e3e8fba36f0cc515a1db015a6e0698292fa
- SSDEEP
  
  96:FS97AaSOEPyvpyvcRakB+z3aZOB2843U+I4mjuHRv843U+I4mjuHRs:67A3O96cRLgz3qH8p4mKHB8p4mKHK
Score

3^/10
behavioral2
- Target
  
  X2 2021 Official/GPPcScConnectionPlugin.dll
- Size
  
  12KB
- MD5
  
  d65463fc8a37261b6bf5afbc4139bdd5
- SHA1
  
  954076a2b56da1ff82eebe0c0c287110137f7cb1
- SHA256
  
  789734bbab7b606e27fab43f4706250399108dba98e4428d1b95589db0a42ea2
- SHA512
  
  cd3673e1feb07dfc86a33d499cddf7f34368bcacbbe8207826b81f9a96d9ebc74e7455170e195ae316785b42dcc871f842dfa1d0949df9f77e8738b8906339b0
- SSDEEP
  
  192:udqzHW3G3Vxv3bV/4DaRWu1Fh8+5FseTqt1emjQjA11Tml3X+EqEvaKGZ:udqzHW3G3DvbV/4Daw27vtTqtQU1xm5D
Score

3^/10
behavioral3
- Target
  
  X2 2021 Official/GlobalPlatform.dll
- Size
  
  767KB
- MD5
  
  4696b9fae32c96d487daa887d830261b
- SHA1
  
  e01f46ed39108d0fb7b57d7ec50fc688fbceb72b
- SHA256
  
  d516e641e63f4195c374ecedbee074c345af178d703fa0761c990141e056b992
- SHA512
  
  0b31bed9e8003ea915013d16561557d46e0ae6e7809d578e27f91dc346379cb47c3f2e50d815f3f49f8135eee5ca72693984eec428137eea2f77e581d1bfb7ac
- SSDEEP
  
  12288:tFmm3ESOWLzt9+5uxqUHudv3p6hUhJO4NdKVAZD53pqYK6oKs:Dx3ESM5uxqUHuJDhJO4n4AZ93pqYK6oJ
Score

3^/10
behavioral4
- Target
  
  X2 2021 Official/X2 2021.exe
- Size
  
  11.7MB
- MD5
  
  066adbdf1d01db495d494aca5f72e41f
- SHA1
  
  6f98d9c4a0ae85023d4f77a50ed2fd4771e3a19f
- SHA256
  
  fef1cad271e2f8aed0e557561577fe6f1ecdb4fbf16a810755d5a90c8f05cf02
- SHA512
  
  d3d8eb6c38d88781a4a1917cfc68ca012fd8484dd04e785a496516307769f41001d6488b0461fc020a3a4115283ebe6d8b059f2b8d4b82ff309d7e24eb1f19fe
- SSDEEP
  
  24576:cPkGgW8ugdGJYDLoL/vddOUmB5I4LjbrMChWVeTsAe+ZWWj80pYWoTIbjpCeT:/wxH1ah4UTtVZWWj8MTbjpl
Score

1^/10
behavioral5
- Target
  
  X2 2021 Official/X2 2023.exe
- Size
  
  1.7MB
- MD5
  
  bda04573188c3d965039d728f00843fe
- SHA1
  
  8b3d7cf132b70f746a041e39e25a42213e5209ea
- SHA256
  
  1824159e5e82f27b0280aeebbfef3a250feb042ce1c3889a375286652306ee0c
- SHA512
  
  ace7d9f93376983bcb67e2b12535ed4466996899eedc6a66c65e821671fde4e18cd4b6a3f6ea92e51696335c5d0d49d13c1722c8019a857bab900677156fb963
- SSDEEP
  
  49152:BLO9XHsGNg3ZxyYvPtLffgnAqo+oO698X/GvquT3Bb:Q/N8HLXtffEAqo+o6/GvP3B
Score

10^/10

chaos persistence pyinstaller ransomware upx
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral6
- Target
  
  X2 2021 Official/X2A.exp
- Size
  
  27KB
- MD5
  
  9658f4486df81e316b74ed4fd729aa44
- SHA1
  
  00d80790ee1878125e4af860a4065eb19324e9f5
- SHA256
  
  13a2deedc0fc750d4221332747dad7acb00ea0f02ad4c0361473fb3d82043bde
- SHA512
  
  75414c247c671ba24f84ab9f7696f5d2313506c717e0b2678bd8d48da2ef84db5e31b1b407b1745fa9985cd4354ffcf3cc127c1fe728eba410c214dbca7361c7
- SSDEEP
  
  384:tYlSb221tQHJ4V4dz7Qdzph/HE+4iKf4OpLewnMTLSG:WsCJ4VukdDHe7ewMTeG
Score

3^/10
behavioral7
- Target
  
  X2 2021 Official/X2A.lib
- Size
  
  45KB
- MD5
  
  c96884a9fd7e6305a5f4972222aafd1a
- SHA1
  
  7421464c820a4f266497430959a6c7a90b64bf4a
- SHA256
  
  1600b8928cea94572789182e8a97f5bbf545dc1281b698f4ddcda8a98516070b
- SHA512
  
  602d914caeb20fd4036ecfd32f5e51057bbbda3cfc16abbb9794c4524a6fea12af520dd26c03276f63851b8275d467c40b1a2447e9da0c4d3207156a6531ebd3
- SSDEEP
  
  384:+kGK8phCYQ1lhFNTX9WBUFwnMTLS6OtnL4P5/rlux4x2h:+kGK8mYYhFNTXsBswMTeTtnUP9lLEh
Score

3^/10
behavioral8
- Target
  
  X2 2021 Official/X2A.pdb
- Size
  
  5.6MB
- MD5
  
  ee17c6d9c85a2e47e75ef25e3f574f5b
- SHA1
  
  d68c8efd824aa307170cd0b1ea806a9ff52bbdb2
- SHA256
  
  c972c60aa8a1d500595312541efd544d378477428cd49f7ab2277460b7ea40bb
- SHA512
  
  69ad02a25149654a1bb9e60de32ac252a2d3cb6f7866056e0137bb03a45d5bdf1afdd5c748fcc48d6f70ba93dbdfe2c97556d38f99df6bbeb3022578940d445a
- SSDEEP
  
  49152:+9awQE0nPazC1CMQg60647XZ1lD0fALKpLFuygh0D3ETvL80loR1EE9r6swpZB7d:KX3UoRmE9r6swt1b1jdR
Score

3^/10
behavioral9
- Target
  
  X2 2021 Official/bins.dll
- Size
  
  2.1MB
- MD5
  
  7ab812d82b3baaf3cd337aa43e91acde
- SHA1
  
  cbb7f418139eada36eaa57d4f39dde11fc577108
- SHA256
  
  c0fd4a64f7e529f3b5e98b70c048e2a2009cba5ba03eb919eaef864000c416cc
- SHA512
  
  d40b019150ca06bf3eed54941f84675529db32d5654bc1ca69af838032552489d2d767372cf7bb18560bef297263a731e96bbaa9d0c9760f1b164f20200c5df7
- SSDEEP
  
  24576:0PkGgW8ugdGJYDLoL/vddOUmB5I4LjbrMChWVeTsAkYGipeT:XwxH1ah4UTtkYVw
Score

1^/10
behavioral10
- Target
  
  X2 2021 Official/cardtemp.dat
- Size
  
  4B
- MD5
  
  f1d3ff8443297732862df21dc4e57262
- SHA1
  
  9069ca78e7450a285173431b3e52c5c25299e473
- SHA256
  
  df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
- SHA512
  
  ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
Score

3^/10
behavioral11
- Target
  
  X2 2021 Official/mac.dat
- Size
  
  3KB
- MD5
  
  3709e18b229e3db113bf5c7863c59db4
- SHA1
  
  bf9a55575d2426852ef2e9a71c23a85391ec4d8a
- SHA256
  
  9dc70002e82c78ee34c813597925c6cf8aa8d68b7e9ce5bcc70ea9bcab9dbf4a
- SHA512
  
  2dd2a6fefb773d737470eae54639dd3440eb7bc10848489596d4b4a3e3d46eb0cbe7620ebb611311bf3375369afa12265c4383c90235915fa141a64f55ab408d
Score

1^/10
behavioral12
- Target
  
  src/MacGyver/javacard/Applet.cap
- Size
  
  22B
- MD5
  
  26ee42ebe16ae2128c11c1e9c4b040c3
- SHA1
  
  2e381bb94ebd27edbebad87204efbc2e32bb0bb5
- SHA256
  
  465fe0f3ea96782336b5e80cfa9368f5a6ead97f8cdf47f125ae1253a7e723ec
- SHA512
  
  a3e3eb89d9c90c3c955afae5edb8d2ea3f48cb91643bdb1e7419ac9011d09b01e60e5dd0fa0e3eda93686f079d0331238f334fd82849e1a137038333e8dccbb3
Score

3^/10
behavioral13
- Target
  
  src/MacGyver/javacard/Class.cap
- Size
  
  17B
- MD5
  
  e04a16f21532c22e60ad9b8ccba81c17
- SHA1
  
  add2e3d6c04eec1860219c5b8ee29d93b38bce8e
- SHA256
  
  918791c1d137ac7932468ce1db56f23a70132cde61f0187b05086e01dfff023a
- SHA512
  
  5653f9033464c3799b58f1e875c4d94421654af73fc7848d9cf44483e5099d375636dcfb303c88155ce403498c17630847aa1ca332907f6c6bf6da53cbd13403
Score

3^/10
behavioral14
- Target
  
  src/MacGyver/javacard/ConstantPool.cap
- Size
  
  89B
- MD5
  
  ecf342b1da7254701b7edd654b7ca4a4
- SHA1
  
  035feee8711e1b1469533a80492d89e3ba4b05ea
- SHA256
  
  7f715383ee8d8524f9a7456c9eb36768dd5876f69d8cc6444917326d36ed385c
- SHA512
  
  7f92bfdff209b35d54025b14bd4da3439c020d0c85b0ed3bcca6a5d17bd5535f1fc11ac924c26db263e3b1e77822d3652e9bc5739d456ec8e654046b952d76af
Score

3^/10
behavioral15
- Target
  
  src/MacGyver/javacard/Descriptor.cap
- Size
  
  203B
- MD5
  
  8e998ed874481cc782e38d8d5e232aa4
- SHA1
  
  7ce7b9d768e6155c763dcc6740c836c12bad9996
- SHA256
  
  feae77f6acfb383e83a2eea87a7417f3806833874dc6a640fe2e3cb5d79622c2
- SHA512
  
  43fd1ed6d77cf511c70ca6b6465932d2996368765bbcfa203b820c194b5432a132884a9a2b055165da13a2e453af7ea661ef12ec333e6f08a8f5972c27e7f57e
Score

3^/10
behavioral16
- Target
  
  src/MacGyver/javacard/Directory.cap
- Size
  
  34B
- MD5
  
  178e488e888513619f6cf65a7d71488a
- SHA1
  
  187608042b350b3faa88578ea4eb720063b69b6a
- SHA256
  
  68731914b1a63b8185335660b95688f4be9a84e4c77417ca6d94f2652725f2d7
- SHA512
  
  2166a947d8559ce3a370ec4006633422e934d8c51e416353226f24a8cbd82673270258f310b705b7be3f77f3cacc393e620233a5ca98c3358ca5a60f0003b347
Score

3^/10
behavioral17
- Target
  
  src/MacGyver/javacard/Header.cap
- Size
  
  27B
- MD5
  
  faabfda1fcb46f4b88e10c035bf0cd02
- SHA1
  
  32c3cde5f7306a6cd90b5ac3ec520babb53ff969
- SHA256
  
  5c780c64f538d792482d0b7355dbaceec9a1b8d294f5d37ece4f0c37ab55fcd0
- SHA512
  
  c8b8765b8d2261dcffa3f38a42362b8d37001815d1c5edc5b85ef4dda0bf77de4972f25c99fb004a77a8139f030b137395fe24752331d53886af7063bfd30c27
Score

3^/10
behavioral18
- Target
  
  src/MacGyver/javacard/Import.cap
- Size
  
  14B
- MD5
  
  c94bf06ea875135f6422b9c34a3b708c
- SHA1
  
  6eb3062ac5703b2f7531ed478eeee82d5e167f13
- SHA256
  
  20cb32cbf18db8c536b22f1904f0a6d99336dde9610fd8d67a53bb3056110c5f
- SHA512
  
  2e971887ddc0c7a809801ca26d25d6eb6df652aebca5611b40c8d8dcb2925fa597b922f25de620795420175c34c33d5f9b50eab43a57a484b4a45484de2c4d99
Score

3^/10
behavioral19
- Target
  
  src/MacGyver/javacard/Method.cap
- Size
  
  1KB
- MD5
  
  2428a629ab3417a26f6bbaff38a68382
- SHA1
  
  d6625f21a46e1fa01d8e2d9b4cba3384bc9a48ec
- SHA256
  
  d7d1def3fff0d5ac262510f23b839ab017bf8757a88e4b08533d4b84f056c420
- SHA512
  
  307863223b92d6ef54220341f55e81113da40a47f5a5ec8fd2bdb4f1b59a537ab3f86133e3c95f56fa5bc8aa240f7d910debaa9048c17051181b5aac481761fb
Score

3^/10
behavioral20
- Target
  
  src/MacGyver/javacard/RefLocation.cap
- Size
  
  151B
- MD5
  
  4114aa211cfffe16197787f8cd75fd92
- SHA1
  
  942a33fa11cd5e9c69b95ae8e8f8f8186157eab2
- SHA256
  
  8f2e4a30e30cab4c45a2b6de9a0bf99a93f34cca1ec227fc7f5742b4368f1f7c
- SHA512
  
  dfb00780e6445af52962f1f1a44e8cbd06d4803db3cd1393084957707a1f3252c417dd2472fd2e0743b58d09cb0a957a8c6336ddd472d9857c458c0114cc5be4
Score

3^/10
behavioral21
- Target
  
  src/MacGyver/javacard/StaticField.cap
- Size
  
  13B
- MD5
  
  72d66147fa090027cf9bd67bc4c16fbf
- SHA1
  
  d1c5974eb53d48347fdc21fa02a6f10b3c906750
- SHA256
  
  eff8a13a0ac0b9c875a045564b5fc5a0041f9db90bc3dad3488ff81713b834f2
- SHA512
  
  23a994389fce3871e150e195c6f1384467f1a9ccbf176d9a04e296d256739ae9ebeb9a241b4d710301c35ce3f3f16734d384806959affb58ad6802dfdea73bbe
Score

3^/10
behavioral22
- Target
  
  X2 2021 Official/mac2.dat
- Size
  
  14KB
- MD5
  
  cbf974e9db892e5105c2ad1d4013b1dd
- SHA1
  
  479af013b15356b40089a0e9e632536dae25a562
- SHA256
  
  e82114e55c2eaec534ed78f59258aae46da1e343476bdc4ea236ca5fa1e4047a
- SHA512
  
  db392596f02e80ff60291577eaa06461cf3afd1d047c8ef921cf3f7fe4b399dd3d6d87ba259a00c877d4a8d0a6ac081103b61c9e7a342e0c0d8e516de2127cb7
- SSDEEP
  
  384:zqURbN0nSpg4S6GWUXe1gXkHpY7vU+ViFUDiYOoizB:zq4OIP/7ukHpY7v/ViFgiYbit
Score

1^/10
behavioral23
- Target
  
  main/javacard/Applet.cap
- Size
  
  21B
- MD5
  
  b76a6a0bbdb2a96a341ca748e08bd14a
- SHA1
  
  5b9ec45322932b0110c6f02c76ec5fc54556c8cc
- SHA256
  
  e382b4373e616111fd4373d23b3e69d0c772e723e31af9d8de387a9af0156c4b
- SHA512
  
  ec3c9609ed4e76ec2e43bcce399989594cb890ea074be416a417e95bf96bb8fa9e33e4e0951a2931971e9e2be765c37f38bf9f47ff7470ccda1ebccda79dd5da
Score

3^/10
behavioral24
- Target
  
  main/javacard/Class.cap
- Size
  
  18B
- MD5
  
  75224b661cb3864ef9c75893e2d38901
- SHA1
  
  ed6f1ef5bbe4dc6d78c52e73fea57b209c339c8c
- SHA256
  
  03579e4edb194dc93193ba80530a14333fe8f506fca77af8fc6e8782e910aa0a
- SHA512
  
  69b70ec1d0303ff6e176f6e23f8a99b1e909364f687dbb1afdace59ce12034ded2f263ce13774eab6480b36909e0b051c3c9e67310c1acaa0db1a5d19e79cf7b
Score

3^/10
behavioral25
- Target
  
  main/javacard/ConstantPool.cap
- Size
  
  317B
- MD5
  
  4b30758328c5820daacbd50535093ec3
- SHA1
  
  8a19750e6835bf1f003baa8ee485ded90bd07611
- SHA256
  
  ad26a917ec530dae9b7c326f2cc70d5819b17ffc8f6a2519fb75ebf859839d65
- SHA512
  
  0c0d8fc5e6dd5f6879952b05a0832e08e12835574d70053f7530cebe9f2fcdcf647d4f2ffdea7b04848fda9118f4afe792d3bfd5b2fabba67b570d9fc2a4c3fc
Score

3^/10
behavioral26
- Target
  
  main/javacard/Debug.cap
- Size
  
  7KB
- MD5
  
  bb2769ed81f1a8168e10287135c90ab0
- SHA1
  
  a3d44ccf7c3a7812a08591a7534a6aa2af7773f0
- SHA256
  
  835266a3df20a664485050c3f44356b6dee80ad22f53e3c9dce7c601fdab53e2
- SHA512
  
  ace74a52f001eaf67d71ecc3a0fb874a7ff0c4912e9f05a992e7377b50c9d151eb09198cedd5633e709b09250e120a51bec52523b87fcc91777d0cac11693df9
- SSDEEP
  
  192:FlwuzYx2yeXe1eDv3PPfMHpEQxjIisvLIDCUUViFXHEl1iYOoU:pWUXe1gXkHpY7vU+ViFUDiYOoU
Score

3^/10
behavioral27
- Target
  
  main/javacard/Descriptor.cap
- Size
  
  733B
- MD5
  
  6be31996302f1d5e4dd5d7122d9da06b
- SHA1
  
  e4fa5772939b661ff4d40e825663dd20fbd0ef9f
- SHA256
  
  338af72d6d0d083c787a2fd6b84f9a08f7ac8ae53f523abdeceadda74c6fe71e
- SHA512
  
  96dfd5c97031a5150188273f54391ff9728992946577de75b75fc163749c93531965a283a5c07b47e2257e4b378e2c848d358c99dde46ab4093db4f2a7d5dd54
Score

3^/10
behavioral28
- Target
  
  main/javacard/Directory.cap
- Size
  
  36B
- MD5
  
  3eb2021618ad22bffc92b14bf303b930
- SHA1
  
  aec53d4f757eb26eb074205c03c0984f5915f6d3
- SHA256
  
  693a4c4a0f1425bcb52898b4158d2ff5225705bc4a5112782d35b912bdb39b8f
- SHA512
  
  1e47d4553ed444ebaf02ba1b4d0daedbdac18ea78ce96a6c837e084f35aaab836729ecac25488bdfa399317f2b269f908c84bcc2b13279e72730b8da4aaa7234
Score

3^/10
behavioral29
- Target
  
  main/javacard/Header.cap
- Size
  
  33B
- MD5
  
  572236c8725992c9633236613823aa57
- SHA1
  
  d99daec13b82496794af5ae687c96259a778f443
- SHA256
  
  e543149dc46ba4416d27ecdcb3ce0180209808b0c52e1897b33dbee8fb722f88
- SHA512
  
  2cdb2ab776f50a65da457454c9ce6b64167506615fd918e4c85dc60bd26d20b21ec2e371d6c2f82e7802e5b09990cf4ef6114cf3f480cbb700559bb27ae70671
Score

3^/10
behavioral30
- Target
  
  X2 2021 Official/sqlite3.dll
- Size
  
  628KB
- MD5
  
  2db34c7d07707168429b0b2633ff75c0
- SHA1
  
  0b29505703900208db71e8d8ae0e675fac2c4d57
- SHA256
  
  b645921e5d6ef89a1899d5cde3f3a54caec9280416290922c9d3638d3ecf49ab
- SHA512
  
  fda845b49ca94f7f2e6ca1b52819385adc46000b8cc7f7f58ca9811bbdb4e8afc3954a41a0050c4f5a44f82dc6d9c41dce38f12e81c254ce2088b139f7750d84
- SSDEEP
  
  12288:KdqTscFyl44oV1p7q5QyDYrUb+eGbOTV7KFnAzcR:KJl44Sz7iQbrPdOTJzcR
Score

3^/10
behavioral31
- Target
  
  X2 2021 Official/zlib1.dll
- Size
  
  105KB
- MD5
  
  b8a9e91134e7c89440a0f95470d5e47b
- SHA1
  
  3cbcee30fc0a7e9807931bc0dafceb627042bfc9
- SHA256
  
  42967a768f341d9ce5174eb38a4d63754c3c41739e7d88f4e39cd7354c1fac71
- SHA512
  
  e8583ea94b9d1321889359317e367abc88e90e96d0d9243258244a527ffa2b13ab97d0787693ca328960ceb934ea11eefd14abafd640a654473c26e420d2ec54
- SSDEEP
  
  3072:Y15jVjUqf9CtXH/4UghkGTBfmJyqLEC9BRY:Yf81wpTB+Jyqb
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Chaos Ransomware

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32