Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 12:32
General
-
Target
source/Cov29Cry/Chaos Ransomware Builder v4.exe
-
Size
550KB
-
MD5
8b855e56e41a6e10d28522a20c1e0341
-
SHA1
17ea75272cfe3749c6727388fd444d2c970f9d01
-
SHA256
f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
-
SHA512
eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908
-
SSDEEP
3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
-
Chaos family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 33 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\source\Cov29Cry\Chaos Ransomware Builder v4.exe"C:\Users\Admin\AppData\Local\Temp\source\Cov29Cry\Chaos Ransomware Builder v4.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04rcsqzz\04rcsqzz.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES437C.tmp" "c:\Users\Admin\Documents\CSC93A311291E59481E8DB74CFFCB47FE1B.TMP"3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD514f560fb22fc1cdbe2b2e75df1d1af45
SHA185a1317443ad483b885e1e39e16d513679b0c37c
SHA2565d27657df9cac5533a2629af7e1a012f136a1a34ddd2c253dd53cd65b388d95a
SHA512a839618076c990ab59d0c748a647fc5484708a3674fad72923661545046c2501c614f473bccea8dafb80e276def31533ca92a57d453b416d9bfa0a430eeee950
-
Filesize
23KB
MD5adc3f720b1cdfa580737c30c62e969b7
SHA15f1939cdbf541ea47098b5aa4bdaa544a85a0882
SHA256f66b46db3ee41726d7063a3a7af0fae48fab4660c99ae53843974805a34511b9
SHA512671ffe99d1dc4af7660be37ea37aeeff0c12d3a8ca1224cab83a5d8eb18aadba926ad11bcd1dce879d302556d62a657d69cfa87f76af74bff73668d756d4d31e
-
Filesize
30KB
MD576e03563ee3ab915bce443d213332ee7
SHA1145d7da3c060b50eec81085a8fd05fcc3d849e78
SHA2564c83fba26f2af551ca9044aca13e24ee109228b0c06563ebe75e36a0d294c607
SHA512d40bb7d1d1427557198332d7ccd82182179a5cf2d61d0674f16d1b80104d6a1b111473f32965bbdb48f9e98ac386be5bf0bff7a0f80121bed58e6a482731bc1f
-
Filesize
335B
MD5d86930023c4e92da95e3c64ee41472e8
SHA1ab3fe48a0679ba7fb3ba3620ed85cfc70128482d
SHA256b5635c4585b856650cfefaf3527aba3cf617a3869936c6ff9e2299c2af5fd60c
SHA5126a1252cf0c75c742f64c4ebae765ba3ecd1d549d59b944258f4e70a392325c3f8d62d6bfdb54a584868ae9dd6b27bedfe55804bd41f554fbdcc46b3ce3d3c1d8
-
Filesize
1KB
MD559297da0bd053e52e03c23724898ad9c
SHA1566a2377811a4d34766c53fe1e71d6ed8bc2e16e
SHA2561333be3f6e313464b8a6daf26043c16cca4027a750fb4a73216bc64704a36fa3
SHA512ef06014d92729f1df7dddeb03fd2871207ae0643643ec5173701266b21151ba403c0c02cd343e5619dc3267753434fd90c5c6ad9d2a191da29d59e87d0b83523
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
568KB
-
Filesize
10.8MB