Overview
overview
10Static
static
10ChaosRanso...in.zip
windows7-x64
1ChaosRanso...in.zip
windows10-2004-x64
1ChaosRanso...ICENSE
windows7-x64
1ChaosRanso...ICENSE
windows10-2004-x64
1ChaosRanso...DME.md
windows7-x64
3ChaosRanso...DME.md
windows10-2004-x64
3ChaosRanso...csproj
windows7-x64
3ChaosRanso...csproj
windows10-2004-x64
3ChaosRanso...v4.ico
windows7-x64
1ChaosRanso...v4.ico
windows10-2004-x64
3ChaosRanso...v4.sln
windows7-x64
3ChaosRanso...v4.sln
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...orm.cs
windows7-x64
3ChaosRanso...orm.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...nX.vbs
windows7-x64
1ChaosRanso...nX.vbs
windows10-2004-x64
1ChaosRanso...nZ.vbs
windows7-x64
1ChaosRanso...nZ.vbs
windows10-2004-x64
1ChaosRanso...ler.cs
windows7-x64
3ChaosRanso...ler.cs
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...rm2.cs
windows7-x64
3ChaosRanso...rm2.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...on.vbs
windows7-x64
1ChaosRanso...on.vbs
windows10-2004-x64
1Analysis
-
max time kernel
96s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:22
Behavioral task
behavioral1
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win10v2004-20240910-en
Behavioral task
behavioral21
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win10v2004-20240802-en
General
-
Target
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
-
Size
25KB
-
MD5
d7a37a9c42386f5665eb43275b68c465
-
SHA1
6c7889c842c2bd22cd0bcdc5610e69fb99183705
-
SHA256
4706109b327130d031207749dfdb697d17f3fb1508300d46f774220198acbecf
-
SHA512
d0d1abf736d81634dcd3f10959ae1ef53fdb8e6198802b6b9fc3792e85b1a9db7fad1641df691fd4e3ecd6fe3063d7ba4ad7e15a3f4435e80ae719f7d2d6fecf
-
SSDEEP
384:9Yp4rB9EXmSaKeibOMoWCaAftxLGbAHlGtcBtauJrN5:M4rWmSaMCMoWPAH0tkR5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3096 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\Src Code\CustomWindowsForm\BlackForm.cs"1⤵
- Modifies registry class
PID:1092
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3096