Overview
overview
10Static
static
10ChaosRanso...in.zip
windows7-x64
1ChaosRanso...in.zip
windows10-2004-x64
1ChaosRanso...ICENSE
windows7-x64
1ChaosRanso...ICENSE
windows10-2004-x64
1ChaosRanso...DME.md
windows7-x64
3ChaosRanso...DME.md
windows10-2004-x64
3ChaosRanso...csproj
windows7-x64
3ChaosRanso...csproj
windows10-2004-x64
3ChaosRanso...v4.ico
windows7-x64
1ChaosRanso...v4.ico
windows10-2004-x64
3ChaosRanso...v4.sln
windows7-x64
3ChaosRanso...v4.sln
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...orm.cs
windows7-x64
3ChaosRanso...orm.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...nX.vbs
windows7-x64
1ChaosRanso...nX.vbs
windows10-2004-x64
1ChaosRanso...nZ.vbs
windows7-x64
1ChaosRanso...nZ.vbs
windows10-2004-x64
1ChaosRanso...ler.cs
windows7-x64
3ChaosRanso...ler.cs
windows10-2004-x64
3ChaosRanso...ner.cs
windows7-x64
3ChaosRanso...ner.cs
windows10-2004-x64
3ChaosRanso...rm2.cs
windows7-x64
3ChaosRanso...rm2.cs
windows10-2004-x64
3ChaosRanso...ources
windows7-x64
3ChaosRanso...ources
windows10-2004-x64
3ChaosRanso...on.vbs
windows7-x64
1ChaosRanso...on.vbs
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:22
Behavioral task
behavioral1
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ChaosRansomwareBuilderVersion4-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ChaosRansomwareBuilderVersion4-main/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ChaosRansomwareBuilderVersion4-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.csproj
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/Chaos Ransomware Builder v4.sln
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/BlackForm.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonX.vbs
Resource
win10v2004-20240910-en
Behavioral task
behavioral21
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/ButtonZ.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Compiler.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.cs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.resources
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/MinMaxButton.vbs
Resource
win10v2004-20240802-en
General
-
Target
ChaosRansomwareBuilderVersion4-main/Src Code/CustomWindowsForm/Form2.Designer.cs
-
Size
9KB
-
MD5
2745d51b15634e3b208ed2520792d7cd
-
SHA1
57f7b01e323107330b6e09c6dbef8a05eed63157
-
SHA256
39f39381c4aa25c8c9db40fc2780552ef1e8b41a768171f78f7eb332f103db52
-
SHA512
7bb8a31bcf1581ff2c707420c8250aafbf9db3f20a43ebec9b79c4fd3a4f2e513895baab6baa2ab27eea787711b078931c28cbcc24859e835985b762fea57069
-
SSDEEP
192:apGUtYZdNQjFFicGHQM8FOkf3jVnW0z29eKl2aDhkVyH7evJPLVnBF1/kVnk2UAF:apGeYZdNQNFOkf3jVnW02eKl2SkVyH79
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4828 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\Src Code\CustomWindowsForm\Form2.Designer.cs"1⤵
- Modifies registry class
PID:3132
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828