Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16-11-2024 02:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 59 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agq4wl3i\agq4wl3i.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6145.tmp" "c:\Users\Admin\Downloads\CSC76B2B1A6AB9241D5B651103411CDAD2F.TMP"
        3⤵
          PID:6028
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1676
      • C:\Users\Admin\Downloads\test.exe
        "C:\Users\Admin\Downloads\test.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:1976

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RES6145.tmp
        Filesize

        1KB

        MD5

        82698779e46823c5bfcb05f5224e2c15

        SHA1

        1560fd2f1eb2dec50a7deab10e05ef1d1d2a9dd1

        SHA256

        1dd269b2a01e6d22b593673675182166345aa06cb09436967b1730cb007f71c8

        SHA512

        04e6096622357c50a0d2e9a977581a1bf9d185a7dff9c074f530d019743aaef9264dd3b87122baa5330c19fd34be13416e3fe011500b071e10042f69d5dbaee1

        Download Submit

      • C:\Users\Admin\Desktop\read_it.txt
        Filesize

        964B

        MD5

        4217b8b83ce3c3f70029a056546f8fd0

        SHA1

        487cdb5733d073a0427418888e8f7070fe782a03

        SHA256

        7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

        SHA512

        2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

        Download Submit

      • C:\Users\Admin\Downloads\test.exe
        Filesize

        22KB

        MD5

        76ba04c91863d9926ab0162dfbb25e6d

        SHA1

        533a35120a06ac9d0b5bb614e56e9e89a06489f0

        SHA256

        cedcddaf15e4720a73a219aacb47f0b0fa39ceb0d38d3195f4ba47d0d2a8ad4b

        SHA512

        83887f9afeb1b3579c8e9b5431bc8a7aa8f3f5d07c6d98a36c622c90db6cef3bf9caa834ac572af4a8374f5171ee45959e27e6807ae4e7a7775734c5c5fc201c

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\agq4wl3i\agq4wl3i.0.cs
        Filesize

        30KB

        MD5

        76e03563ee3ab915bce443d213332ee7

        SHA1

        145d7da3c060b50eec81085a8fd05fcc3d849e78

        SHA256

        4c83fba26f2af551ca9044aca13e24ee109228b0c06563ebe75e36a0d294c607

        SHA512

        d40bb7d1d1427557198332d7ccd82182179a5cf2d61d0674f16d1b80104d6a1b111473f32965bbdb48f9e98ac386be5bf0bff7a0f80121bed58e6a482731bc1f

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\agq4wl3i\agq4wl3i.cmdline
        Filesize

        332B

        MD5

        3d201ff91092c00bee2f35ed62579a60

        SHA1

        132f2368f95248bc7f2775d297b1cd2f815ef422

        SHA256

        65375f2fe38426f3ef1cb2c84981acdadcc6ca6493781574023f268d5b0976f4

        SHA512

        a9f68212dbad74b98b43b4bf39c5fe77dc1936393b21be9b7e2ded2725853ea8b2ab4e36fb14e832474cd07185317510a23adf9522a8ae3b74e68abaccfdaf9e

        Download Submit

      • \??\c:\Users\Admin\Downloads\CSC76B2B1A6AB9241D5B651103411CDAD2F.TMP
        Filesize

        1KB

        MD5

        4a8b69d1b2c8695736b8c2273da513dc

        SHA1

        6519bfd357318ebc69831e8c9a12626c5a34dc2e

        SHA256

        d9edfacf147f183b116c4ba680fe1087d13f04fa7dc92ca7e9bc9f2fdbca24b6

        SHA512

        e4bf306c4ff1b6be85fa7824ba7e9c50906e965553fcbcb9debd966220b0328134d99ceedc6d563296332056c243dd310e8fe36e2fee2c3864f7aa67fde225e5

        Download Submit

      • memory/808-24-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/3672-4-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-7-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-6-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-5-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-0-0x00007FFF51773000-0x00007FFF51775000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3672-21-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-3-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-2-0x00007FFF51770000-0x00007FFF52232000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3672-1-0x0000000000F00000-0x0000000000F8E000-memory.dmp

        Filesize

        568KB

        Download