Overview
overview
9Static
static
7Chaos_V2_FIXED.zip
windows7-x64
1Chaos_V2_FIXED.zip
windows10-2004-x64
1Chaos.exe
windows7-x64
9Chaos.exe
windows10-2004-x64
9fpsunlocker.exe
windows7-x64
1fpsunlocker.exe
windows10-2004-x64
1ps.py
windows7-x64
3ps.py
windows10-2004-x64
3pssuspend.exe
windows7-x64
1pssuspend.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 20:29
Behavioral task
behavioral1
Sample
Chaos_V2_FIXED.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Chaos_V2_FIXED.zip
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Chaos.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Chaos.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
fpsunlocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
fpsunlocker.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
ps.py
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
ps.py
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
pssuspend.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
pssuspend.exe
Resource
win10v2004-20240412-en
General
-
Target
fpsunlocker.exe
-
Size
666KB
-
MD5
f0c71376e55ba3c65942e90348169921
-
SHA1
239085aa264e9eb743dde706231169820c32e03c
-
SHA256
94f4140b6e7c3e73364205829da26479dad5257752c009dca4dec4a6ce9f9637
-
SHA512
4ce20f764aac880362fbf9f9ade18c89e19eaa697e73cb08ce37b2eb25b3b655ec569de180c33ded00ca42147dd2c84d21b837224b318d56f258a6e881b6057f
-
SSDEEP
12288:4KOjJsDc2+WC+D+4H/xeGofENaTSuGCC709:4KyacgDD+4fwG1NaTSw
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fpsunlocker.exepid process 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe 4820 fpsunlocker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
fpsunlocker.exepid process 4820 fpsunlocker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
fpsunlocker.exepid process 4820 fpsunlocker.exe