Analysis
-
max time kernel
1744s -
max time network
1753s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
02-05-2024 15:15
General
-
Target
Ransomware-Builder-main/Chaos Ransomware Builder v4.exe
-
Size
550KB
-
MD5
8b855e56e41a6e10d28522a20c1e0341
-
SHA1
17ea75272cfe3749c6727388fd444d2c970f9d01
-
SHA256
f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
-
SHA512
eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
-
SSDEEP
3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-0-0x00007FFE8C563000-0x00007FFE8C565000-memory.dmpFilesize
8KB
-
memory/692-1-0x00000000006D0000-0x000000000075E000-memory.dmpFilesize
568KB
-
memory/692-2-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmpFilesize
10.8MB
-
memory/692-3-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmpFilesize
10.8MB
-
memory/692-4-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmpFilesize
10.8MB
-
memory/692-5-0x00007FFE8C560000-0x00007FFE8D022000-memory.dmpFilesize
10.8MB