Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-09-2024 09:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note
All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $100. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies registry class 57 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bjwy54l\2bjwy54l.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES899D.tmp" "c:\Users\Admin\Desktop\CSCF12B18BEA6FD4621A653A5E2A201575.TMP"
        3⤵
          PID:4760
    • C:\Users\Admin\Desktop\eee.exe
      "C:\Users\Admin\Desktop\eee.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:3572
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
      1⤵
      • Modifies Internet Explorer settings
      PID:1172

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES899D.tmp
      Filesize

      1KB

      MD5

      e02904510740ff579a74a928a90ac82a

      SHA1

      10042d40f45720bdf380ad8b92d34ba9bead20ed

      SHA256

      d092401b4ac29c6077d7f42966cf9b5ab20bce58f056c03d8341448cfb38ac53

      SHA512

      c7dacf6e6eb869f0ac3e9aa40aafafb77f8cbda9178d3a33a57027e0aec620267ebdf498d122076e20ccf4b6d94cf1ef4b2e3912782ea49f56660ce1a38e615a

      Download Submit

    • C:\Users\Admin\Desktop\eee.exe
      Filesize

      22KB

      MD5

      fa54d3a10f44cbec8349b16d21ee387e

      SHA1

      3fce04201c1254986699e93138490e33c0a36476

      SHA256

      bc54473c515cbc369ec3ed9a8921cfb8c03244350398aed896aef19d772f615e

      SHA512

      7022390c6c98279fdee738a2e16b113c2a94d35627977ace804c4e70b2c60dd446ea3b9dec8656ae64d3d04d224b16b262324d6a8d2976c42c37706b439666de

      Download Submit

    • C:\Users\Admin\Desktop\read_it.txt
      Filesize

      879B

      MD5

      f34a98b4eba46d22d96a8cbecb54902d

      SHA1

      2dedd1c7a83b9c2fb75c1730337504301d09e90a

      SHA256

      949aa446dd254fbb51fceae5de3fd5065db19a9157510b27168fd4d01ff650a6

      SHA512

      289471748774dcdd1081cc9c499758f26b1946af39ae87e353f32dd42b4c8b9dac2895c4a9f0196ea7170503d082a2a782b67a63bf1c6e9760dbb3da4aa73be1

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\2bjwy54l\2bjwy54l.0.cs
      Filesize

      30KB

      MD5

      bb1dfae3a78c3f5c05366924a6faebd3

      SHA1

      013cce8443c4a4f41308dfc5207d4b16e02dac15

      SHA256

      b818ab212f2541adbee7063dcab16a4bd904973d8c9517f967e747e38acd522d

      SHA512

      fd54dcfcb631ac8209bfbe0afbd701bff71a952791370cb4e177a13802f34e347df132bd4b7010d9a1507251aa94cb3fbbeb102e28632c2dd8c1ef28c92861f1

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\2bjwy54l\2bjwy54l.cmdline
      Filesize

      329B

      MD5

      de46d0e760e28c756d5f075253badc6f

      SHA1

      32700e37dcfb9f015e6ec6009de2b6151d652ae7

      SHA256

      6abe0033a48cc7b808d0c522d49a1183de4212b4552cb924c4883adec90b114a

      SHA512

      6bc9c99d3abbf6c36537b78680e2aa025fcf50cc1bf387d104f8dab7387609744da4cc2b8f173c9d6451867f0de8f4bff0adffd2461027e8c7b7bba76a62b882

      Download Submit

    • \??\c:\Users\Admin\Desktop\CSCF12B18BEA6FD4621A653A5E2A201575.TMP
      Filesize

      1KB

      MD5

      3f33bff10898e0a2271ec42452267a52

      SHA1

      83509c1785d24462234802480b5ee785b6d32791

      SHA256

      19276e53cc56d418964d348c55b8e484d9babeb2d106eaed953f97b1413b3c51

      SHA512

      d7e9ed2a545bc02a7c4340bed4cb55b3fa97a0b814b1e0176318d4c5dc9227137a7c887b4ec75c5fbcb1e6bc6e6962f0c4b7f0b350fe57e57949f451058c7725

      Download Submit

    • memory/2456-4-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-7-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-6-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-5-0x00007FF8017B3000-0x00007FF8017B5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2456-0-0x00007FF8017B3000-0x00007FF8017B5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2456-3-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-20-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-22-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-2-0x00007FF8017B0000-0x00007FF802272000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2456-1-0x00000000008C0000-0x000000000094E000-memory.dmp

      Filesize

      568KB

      Download

    • memory/4500-25-0x0000000000840000-0x000000000084C000-memory.dmp

      Filesize

      48KB

      Download