Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows7-x64

10

Resubmissions

30-05-2024 09:29

240530-lf8wksea65 10

30-05-2024 09:22

240530-lb9mbach7y 10

Analysis

  • max time kernel
    316s
  • max time network
    316s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 09:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 6 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 32 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5bjk0t50\5bjk0t50.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA795.tmp" "c:\Users\Admin\Documents\CSC3F2D0D0E5A874AF983BAA04258BC7A1.TMP"
        3⤵
          PID:1748
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2796
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x560
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
      • C:\Users\Admin\Desktop\goodli.exe
        "C:\Users\Admin\Desktop\goodli.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Users\Admin\AppData\Roaming\winlogon.exe
          "C:\Users\Admin\AppData\Roaming\winlogon.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2340
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:2080
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:2784
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1908
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:1884
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Important file.txt
            3⤵
              PID:864
        • C:\Users\Admin\Desktop\goodli.exe
          "C:\Users\Admin\Desktop\goodli.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1360
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1716
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2952
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:756
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
              PID:1440
            • C:\Program Files\VideoLAN\VLC\vlc.exe
              "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\EditRequest.MOD"
              1⤵
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:1208
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\EnableRedo.rar.d76s
              1⤵
              • Modifies registry class
              PID:2128
            • F:\surprise.exe
              "F:\surprise.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1000
              • C:\Users\Admin\AppData\Roaming\winlogon.exe
                "C:\Users\Admin\AppData\Roaming\winlogon.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:212
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x0
              1⤵
                PID:1908
              • C:\Windows\system32\csrss.exe
                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                1⤵
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:1876
              • C:\Windows\system32\winlogon.exe
                winlogon.exe
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1740
                • C:\Windows\system32\LogonUI.exe
                  "LogonUI.exe" /flags:0x0
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2348

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\RESA795.tmp
                Filesize

                1KB

                MD5

                131a6db1dc7dba8799c7ed1ad2e988d9

                SHA1

                93b03719f4816766d85e5dd5facd5c88c922ccf8

                SHA256

                e765726e71f24ee418a77d185fff5a5177a8fad0a1c3f9ef09048ad50fb20d0b

                SHA512

                a4f6612f735f2e70be1fd4a0dfc539a71df898344127b71f3fb1c3c8c172425a6c4a6c93a8303a21ef88c5da42e753ce0dbc2883a0f35111d474a2abfa5bb3bf

                Download Submit

              • C:\Users\Admin\Desktop\goodli.exe
                Filesize

                22KB

                MD5

                56a1fd203197d07008ebd509d0297e73

                SHA1

                01fb87a0f8ed3f6ffe5fb85d3e4d574712f7ea91

                SHA256

                2d419e9b2dc09f1a6e76102e59440c57609ef361393ebea311951b7af2508498

                SHA512

                9c70ddaaf012c9e6f995857f02869fc63b7b232fc49a62797122ed4561c703db48fdcc707ff04c7d4f7a5271d5bd8c6f43bbf35769da0bd463d1928cf54936b1

                Download Submit

              • C:\Users\Admin\Documents\Important file.txt
                Filesize

                57B

                MD5

                b143053f53d38633f2ce51429a924759

                SHA1

                b68ea31104b3e47501d3bb07a42e141269837b21

                SHA256

                ef26327e4165f43f797585123121c358b4d790ee11443d83ad34cddacf724f0f

                SHA512

                66ceba6d91129bd28557bc2310de6c4ca2db8d09542d47fa3d5bf865b897f120a64787438a5d61dcacc6b142b3ecdc3d542c965bd43fa0f776d07b88dd438b8e

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\5bjk0t50\5bjk0t50.0.cs
                Filesize

                30KB

                MD5

                a95f2d5af3c86c13c5dc852756f18196

                SHA1

                606f8c107e0a09329cc00bc3c03005bd30d911ea

                SHA256

                d12fa2e8a78a7dc2a7d9dda8e75a7819b8a6dd5a5ba1bede83ccb41bfd88acd5

                SHA512

                b0204ed24e830a0d3ea0894d6dc3014de78faf67cd4ff43333ef66d91e84382e4412331bfb2fdfd319ecc069a0d3489dd8bf9a957983f93577f6316d61e3d338

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\5bjk0t50\5bjk0t50.cmdline
                Filesize

                334B

                MD5

                777f38effc19ebb3878119e87ae95fbc

                SHA1

                1dc9c42d0f915bcfcebe8c6eb0e0682a33f43b13

                SHA256

                f1e0baa3db013868cdc76c0d0dd0f30f42ebb87a25de441fd2bda9d86ea2822e

                SHA512

                19805f214d1380036db65759f3edd3bc9c4702958e18dddf02d4a93eea04275686b31f632cd199b4e5e804c1a324a94ec0c370b1977f660fd406b93375889418

                Download Submit

              • \??\c:\Users\Admin\Documents\CSC3F2D0D0E5A874AF983BAA04258BC7A1.TMP
                Filesize

                1KB

                MD5

                41555e95ae96a65e1a8db6ddbc1e2a04

                SHA1

                c0e912191ee2010dbaf6c7e6cf294abb973a8ec2

                SHA256

                eba0b5a5af16742b840cf3c8144a0ab1b3812becb58507aba1cf639d623d4406

                SHA512

                632c343f66a898b15d49111750e2ccab51de782de2fbd76714d5bc54f5246a66d3a122cffe0e9a9b9a8bcda2c1927b8e061739eb9d755547261eebdf456f456c

                Download Submit

              • memory/1000-499-0x00000000013E0000-0x00000000013EC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1072-31-0x0000000001320000-0x000000000132C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1208-493-0x000000013F0C0000-0x000000013F1B8000-memory.dmp

                Filesize

                992KB

                Download

              • memory/1208-494-0x000007FEF43B0000-0x000007FEF43E4000-memory.dmp

                Filesize

                208KB

                Download

              • memory/1208-495-0x000007FEF2380000-0x000007FEF2636000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/1208-496-0x000007FEEABD0000-0x000007FEEBC80000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1716-34-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1716-484-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1716-33-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1716-485-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2396-40-0x00000000011C0000-0x00000000011CC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/2400-13-0x000000001ED70000-0x000000001ED80000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2400-4-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2400-14-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-3-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-0-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2400-12-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-1-0x0000000000100000-0x000000000018E000-memory.dmp

                Filesize

                568KB

                Download

              • memory/2400-11-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-6-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-5-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-2-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2400-28-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

                Filesize

                9.9MB

                Download