Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows7-x64

10

Chaos Rans...v4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    160s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2024 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\hello.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: de

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 5 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 47 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jnrqzcjm\jnrqzcjm.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF086.tmp" "c:\Users\Admin\Desktop\CSCDC028D2A667C4E0386553541485EDFE.TMP"
        3⤵
          PID:552
    • C:\Users\Admin\Desktop\test.exe
      "C:\Users\Admin\Desktop\test.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:2976
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1936
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:1080
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:1516
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:2464
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\hello.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          • Suspicious use of FindShellTrayWindow
          PID:1400
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1396
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2760
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:3036
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:304

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RESF086.tmp
          Filesize

          1KB

          MD5

          f198bc9c6906249b0027ce210380c7c2

          SHA1

          31bf5012a3141f0f4f13ef0de4344ef3be13f995

          SHA256

          1dd570182559f8be16318145ebf1d383f27eee96363b0d40974b0f0e5f3f4ff9

          SHA512

          6737a80b1c5912d3d1956f615dc8277e28a62ca9b7b6d9bee63faa035893efe49990296e6ce71004137342b5a42b965f8c8581083627e3560bc4943a76a03cbe

          Download Submit

        • C:\Users\Admin\Desktop\test.exe
          Filesize

          23KB

          MD5

          8f0f0910e64f1f2e6fd93ec1a760b854

          SHA1

          5a3a6819be71cab04163ed3a43bc84d956f12c94

          SHA256

          c5f04730672b056e0eee1d4445d1f9cd9c5f3b8289c18733249b60d32cd7be42

          SHA512

          01e0df8aace082cd4984e0994914848450198299a7b8ea0b1624ea8a1f7dc306c7cb28ca9c37831dc5e211864f4f483274f804cb7e2b25d6c920f43c0d7f0331

          Download Submit

        • C:\Users\Admin\Documents\hello.txt
          Filesize

          924B

          MD5

          73b319e034e418e31493d6c1c45906ec

          SHA1

          a370dab258fac340b868b3bb300cbb53dd27bc3e

          SHA256

          2b89cc861b41b46d42b8594af12968d9b937e893f8f3ab73a5b4e6cb847fe42b

          SHA512

          1d04b7b570dcfb6fdac6d08ef9763bc8983844e3fe0c9234810f0308f93b4ccd577b9a2c294987540f835222d9d5eb4ade56b26a003418dac50f4faff1bb8b84

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\jnrqzcjm\jnrqzcjm.0.cs
          Filesize

          31KB

          MD5

          1031b477cdd87d8ec30efd863e19a5d6

          SHA1

          12ac09f8f501e55e61d6f671956a2d2e410a8622

          SHA256

          7d744e20cf65869365ea0cdc8ea82bbd912ac2b3cbeb8eb07a93cfb5f1bdf152

          SHA512

          9ce8d9c1885efedfb1f6b264ba5ce4c1a467b8d160e28fe4347d83c2197784a7fec0686eae3ccef6a56ef754a363c67ca4e649529f0d52feca73ad60af31a012

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\jnrqzcjm\jnrqzcjm.cmdline
          Filesize

          330B

          MD5

          d3583a2aea28fd1901d23dad4ab07f9b

          SHA1

          92d6091f2b9754395b129195329f96a168e34f39

          SHA256

          ce56297c5e7bb60793d2360e5d5d34b015cb9c9c2e489273be51858ebff05ac6

          SHA512

          b3c3b687b1044021b799e705f791b82939f6e8d11836dba31327d1df9f0b2a9a6b2b5b4f05d8da7c6d92a5ff70cfdc151bd5fe617e7226828701c9635a0d228e

          Download Submit

        • \??\c:\Users\Admin\Desktop\CSCDC028D2A667C4E0386553541485EDFE.TMP
          Filesize

          1KB

          MD5

          4a8b69d1b2c8695736b8c2273da513dc

          SHA1

          6519bfd357318ebc69831e8c9a12626c5a34dc2e

          SHA256

          d9edfacf147f183b116c4ba680fe1087d13f04fa7dc92ca7e9bc9f2fdbca24b6

          SHA512

          e4bf306c4ff1b6be85fa7824ba7e9c50906e965553fcbcb9debd966220b0328134d99ceedc6d563296332056c243dd310e8fe36e2fee2c3864f7aa67fde225e5

          Download Submit

        • memory/1096-27-0x00000000012C0000-0x00000000012CC000-memory.dmp

          Filesize

          48KB

          Download

        • memory/1892-33-0x0000000000860000-0x000000000086C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2280-4-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2280-11-0x000000001EEF0000-0x000000001EF00000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2280-10-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2280-5-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2280-24-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2280-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2280-3-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2280-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2280-1-0x0000000000900000-0x000000000098E000-memory.dmp

          Filesize

          568KB

          Download