Overview
overview
10Static
static
10ChaosRanso...in.zip
windows7-x64
1ChaosRanso...in.zip
windows10-2004-x64
1ChaosRanso...ICENSE
windows7-x64
1ChaosRanso...ICENSE
windows10-2004-x64
1ChaosRanso...DME.md
windows7-x64
3ChaosRanso...DME.md
windows10-2004-x64
3ChaosRanso...csproj
windows7-x64
3ChaosRanso...csproj
windows10-2004-x64
3ChaosRanso...v4.ico
windows7-x64
1ChaosRanso...v4.ico
windows10-2004-x64
3ChaosRanso...v4.sln
windows7-x64
3ChaosRanso...v4.sln
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...orm.cs
windows7-x64
3ChaosRanso...orm.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...nX.vbs
windows7-x64
1ChaosRanso...nX.vbs
windows10-2004-x64
1ChaosRanso...nZ.vbs
windows7-x64
1ChaosRanso...nZ.vbs
windows10-2004-x64
1ChaosRanso...ler.cs
windows7-x64
3ChaosRanso...ler.cs
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...rm2.cs
windows7-x64
3ChaosRanso...rm2.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...on.vbs
windows7-x64
1ChaosRanso...on.vbs
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 23:22
Behavioral task
behavioral1
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win10v2004-20240910-en
Behavioral task
behavioral21
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win10v2004-20240802-en
General
-
Target
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
-
Size
25KB
-
MD5
d7a37a9c42386f5665eb43275b68c465
-
SHA1
6c7889c842c2bd22cd0bcdc5610e69fb99183705
-
SHA256
4706109b327130d031207749dfdb697d17f3fb1508300d46f774220198acbecf
-
SHA512
d0d1abf736d81634dcd3f10959ae1ef53fdb8e6198802b6b9fc3792e85b1a9db7fad1641df691fd4e3ecd6fe3063d7ba4ad7e15a3f4435e80ae719f7d2d6fecf
-
SSDEEP
384:9Yp4rB9EXmSaKeibOMoWCaAftxLGbAHlGtcBtauJrN5:M4rWmSaMCMoWPAH0tkR5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
AcroRd32.exepid process 2600 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2600 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2600 AcroRd32.exe 2600 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exedescription pid process target process PID 2732 wrote to memory of 2600 2732 cmd.exe AcroRd32.exe PID 2732 wrote to memory of 2600 2732 cmd.exe AcroRd32.exe PID 2732 wrote to memory of 2600 2732 cmd.exe AcroRd32.exe PID 2732 wrote to memory of 2600 2732 cmd.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\Src Code\CustomWindowsForm\BlackForm.cs"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\Src Code\CustomWindowsForm\BlackForm.cs"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e88f95584ba6b9b8e4d5d7c8ae7e2d14
SHA10a08f29382d943f0b14223f13cadd41d12306ec5
SHA256c539df90518b707bd7de4b9cf36217555c63812d72426b45627ef1c4b39fae92
SHA5128ee8be9d22416c38855fc61368baca31272dd1e1cebfa9a4e4cb7ab69e7e9b158527e71cd8870795124f398adcd6a2855d1bbfda5f8fb690642a02ac95fe4055