chaos | 4e16b172ddbdbc7eadb9c19aec4395063dd5c46d10cc3fa6e0354a9b882ba226

Analysis

max time kernel
95s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
Size

25KB
MD5

900008874bc095685fc50680e81091fa
SHA1

7b3de1fea9df5814cce8ef4a7590b44f1edb9389
SHA256

4e16b172ddbdbc7eadb9c19aec4395063dd5c46d10cc3fa6e0354a9b882ba226
SHA512

d7b42f1e85ddba5c0173b1ad857c09a650e2d3e7cd89eabe9797a3f9b7a9f649b51757a0867ff4428fd7ccbf11dde0879e62458f3d58a2f88aa6a30a109b22ca
SSDEEP

384:r0JORJE7LK87ghRygQNdEWI23SOVs91V9H0b5QWv:rJX8qJWet9pUbaO

Score

10^/10

chaos ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/388-1-0x0000000000EF0000-0x0000000000EFC000-memory.dmp	family_chaos

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe

C:\Users\Admin\AppData\Local\Temp\20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe
"C:\Users\Admin\AppData\Local\Temp\20240925900008874bc095685fc50680e81091fachaosdestroyerwannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-0-0x00007FFFB7D93000-0x00007FFFB7D95000-memory.dmp

Filesize
8KB

Download
memory/388-1-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

Filesize
48KB

Download
memory/388-2-0x00007FFFB7D93000-0x00007FFFB7D95000-memory.dmp

Filesize
8KB

Download