Analysis
-
max time kernel
315s -
max time network
885s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
-
submitted
24-06-2024 11:31
General
-
Target
what-encrypt.exe
-
Size
263KB
-
MD5
d61c38b3d1ba714b8455eb2cf6021bac
-
SHA1
3d81c5d0643886d4cf3d358e274c7fbb83f72021
-
SHA256
ad533886f13a9753d17974ad2836712504e59460675f354d7d84329b157df08c
-
SHA512
42b36e010d534a7b975fee95707172fa63dd466bfad6adb38c401098911a5beb6accd5c6972a3b859ae0938e894524bcdb1dbc68d96214bf9412b7108885ce49
-
SSDEEP
6144:hLP6qRuHl7BuEHwRgDDQWC+H6fqmt3N5bJEjJ:hOqwHltucwRM4FjJE
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\what-encrypt.exe"C:\Users\Admin\AppData\Local\Temp\what-encrypt.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 7762⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
-
Filesize
276KB
-
Filesize
148KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
276KB
-
Filesize
148KB
-
Filesize
340KB
-
Filesize
276KB
-
Filesize
28KB