Overview
overview
10Static
static
10ChaosRanso...in.zip
windows7-x64
1ChaosRanso...in.zip
windows10-2004-x64
1ChaosRanso...ICENSE
windows7-x64
1ChaosRanso...ICENSE
windows10-2004-x64
1ChaosRanso...DME.md
windows7-x64
3ChaosRanso...DME.md
windows10-2004-x64
3ChaosRanso...csproj
windows7-x64
3ChaosRanso...csproj
windows10-2004-x64
3ChaosRanso...v4.ico
windows7-x64
1ChaosRanso...v4.ico
windows10-2004-x64
3ChaosRanso...v4.sln
windows7-x64
3ChaosRanso...v4.sln
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...orm.cs
windows7-x64
3ChaosRanso...orm.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...nX.vbs
windows7-x64
1ChaosRanso...nX.vbs
windows10-2004-x64
1ChaosRanso...nZ.vbs
windows7-x64
1ChaosRanso...nZ.vbs
windows10-2004-x64
1ChaosRanso...ler.cs
windows7-x64
3ChaosRanso...ler.cs
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...rm2.cs
windows7-x64
3ChaosRanso...rm2.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...on.vbs
windows7-x64
1ChaosRanso...on.vbs
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:22
Behavioral task
behavioral1
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win10v2004-20240910-en
Behavioral task
behavioral21
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win10v2004-20240802-en
General
-
Target
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
-
Size
116KB
-
MD5
df38993dea2e1a76a0be3c541db54a72
-
SHA1
563c9e87762a27c9f794bcbf2bf00aab10e33b06
-
SHA256
5a2ddd4b8d32f88a17c771e5ed1f1e4f90175fc3711ff7b026dc2e328ef0e2b4
-
SHA512
a9f09c93a86ee919a1efe4c8ed1019a9b86b76492eba7555f411011635f774b1ecea9eb60323e026b0a85371fc5382c7ae425048c99756aa505f662adb52d79d
-
SSDEEP
768:3GLYL6fkEP2nPHLM9KKuRYxSR8xobxlyKzWI6ck6HvgC+I1+pLqe:3Ik6sq2njM9qRYxSKGxly16Pn6RT
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1520 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\Src Code\CustomWindowsForm\BlackForm.resources"1⤵
- Modifies registry class
PID:2100
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1520