Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows7-x64

10

Chaos Rans...v4.exe

windows10-2004-x64

10

Resubmissions

30/05/2024, 09:29

240530-lf8wksea65 10

30/05/2024, 09:22

240530-lb9mbach7y 10

Analysis

  • max time kernel
    135s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 09:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 5 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 59 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pndpgekg\pndpgekg.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFBD.tmp" "c:\Users\Admin\Downloads\CSCD00A7F4821DE415DBCF2DC4857A9C86F.TMP"
        3⤵
          PID:2460
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2524
      • C:\Users\Admin\Downloads\random.exe
        "C:\Users\Admin\Downloads\random.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2092
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:976
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2168
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1732
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:468
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:2904
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2892
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:1176
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:2460
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:572
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1540
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1672
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:2376
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
            PID:2644
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk.l1di
            1⤵
            • Modifies registry class
            PID:1808

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RESCFBD.tmp
            Filesize

            1KB

            MD5

            3564622cd7ff959e9c7c544bb243284f

            SHA1

            d8a77012f2ae93d1f6dfba04c835dfbf4128297b

            SHA256

            564319f9a9fa8b8ff8731ac67db00823c8096bd5f914fc1bb70eb99757e6a600

            SHA512

            45e96ab3d7c14b8b96d877c3cdce89c01c2c79737dfa70a070d52f63eeb34a8588d6c30eb5d7731a0ec0961856cb58e9448aea813e127f87cb4342cf6937b24a

            Download Submit

          • C:\Users\Admin\Documents\read_it.txt
            Filesize

            964B

            MD5

            4217b8b83ce3c3f70029a056546f8fd0

            SHA1

            487cdb5733d073a0427418888e8f7070fe782a03

            SHA256

            7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

            SHA512

            2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

            Download Submit

          • C:\Users\Admin\Downloads\random.exe
            Filesize

            23KB

            MD5

            36c58256c4914a08ece6f8962c4218ac

            SHA1

            afb61f2ab0fda45cd32ebff76523d256691a3359

            SHA256

            1a36b5dc8f810e0cb2da7aa2e9240df8312ed0f8a18db43171b9780098723b76

            SHA512

            6015dd6f0e0c37d2ad26221a426cd1b9df42e32cef9c05fcd631aa55c6b0c5daae83cd66231c00f69bf0699b3db78102920a80a6269511c383a7bfcb6f4202c9

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\pndpgekg\pndpgekg.0.cs
            Filesize

            31KB

            MD5

            08790f857385afc2537ce793bde95453

            SHA1

            1dfb72dbf3af84edc0bd48fa4a65922fa8271c61

            SHA256

            a7ed086cd2a039f2747d66a63dbfff64549fd38c71958019c55266ddb268fbe3

            SHA512

            e66694502f72d75f604d2f668373219a408ae8437fc95155bbeab3c803c2c6e04e4827ff5377c8607817bb0ea5639ac735b0c2aa8de7c2d12bbf8a8d30ca4742

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\pndpgekg\pndpgekg.cmdline
            Filesize

            334B

            MD5

            ac213e667b6ec2a834441289d741cbdc

            SHA1

            fa750e7f96070b5d4683525023b05bb9a42ddfde

            SHA256

            55cc71c36bdaabe152d23aed10621636039c9f1e0f44f664daeb3ece98f1b884

            SHA512

            ddf3bc39916c8d318683ddf253d8c9a461f2e79f532544d019f37586b941753f4582bfca063dc0caa5657f707ad209b74627d3b92fd037246ada119db8a6843e

            Download Submit

          • \??\c:\Users\Admin\Downloads\CSCD00A7F4821DE415DBCF2DC4857A9C86F.TMP
            Filesize

            1KB

            MD5

            2ce885df62118292d5cc023dd411caf4

            SHA1

            e53ead2fe6f9b437beb545c29a51ae1c13afda28

            SHA256

            c98748876ee8b1091b9041d1f00f760d5511c5240b7f41c81f44f65b54c285d7

            SHA512

            8b34c99539c33148f1d402774768297388fdc28cd528c0d5cc7e5c72138fe1ca80485094d9b0dac84e4470932b8e18aba298051246f820ba432702421907c9f6

            Download Submit

          • memory/572-429-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/572-428-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/1616-29-0x0000000001330000-0x000000000133C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/2084-35-0x00000000010F0000-0x00000000010FC000-memory.dmp

            Filesize

            48KB

            Download

          • memory/2740-13-0x000000001EBE0000-0x000000001EBF0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2740-4-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2740-0-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2740-3-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-26-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-2-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-5-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-12-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-1-0x00000000010A0000-0x000000000112E000-memory.dmp

            Filesize

            568KB

            Download

          • memory/2740-11-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2740-6-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

            Filesize

            9.9MB

            Download