1c5945ba631e642a275fb2b967c15a047b50640bb8d71908387d90074ef3bbdd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChaosRansomwareBuilderVersion4-main/README.md
Size

437B
MD5

88776154387c8af62b421162a4ec865c
SHA1

de3be11123b1c571888ec19c5403abc4e5be57bf
SHA256

cfcd9d4617aacd44b506107c21060c95269820a8d4dd3b533a3c6e3c80efbf55
SHA512

8c894ba2d77b87baee619706e56097326f973b1ec14eee79b46b366e253366b7610d9f888cc8ecef0c08c3591728ab234791eaba5b65a5670201efac95b33601

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2828	2184	cmd.exe	31
PID 2184 wrote to memory of 2828	2184	cmd.exe	31
PID 2184 wrote to memory of 2828	2184	cmd.exe	31
PID 2828 wrote to memory of 2716	2828	rundll32.exe	32
PID 2828 wrote to memory of 2716	2828	rundll32.exe	32
PID 2828 wrote to memory of 2716	2828	rundll32.exe	32
PID 2828 wrote to memory of 2716	2828	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderVersion4-main\README.md"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c5c78ca7a4a09f93befda6c3e32ae239

SHA1
40d17fd0b3a3934dafda115005f9776e160eeba8

SHA256
286fcfaf00d1927041bdf43f87e027e3da848c6611def5dcef542b2ae2667e4d

SHA512
48121bf1385ce55f453abbec33c62f76895cbc0a6f6951c72debbef58c99a05a0c5e69e44cb978279e0e3d154e5973eb1a1f40be53409b7a1fd132000377a22c

Download Submit