Analysis
- max time kernel
91s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
25/11/2024, 16:29
General
- Target ChaosRansomwareBuilderv5.2.exe
- Size 560KB
- Sample241125-tzd5baskbj
- SHA256 38adb3e1431726978b41a80227f22159fddfaeed174ddd2d569e6de4177d3589
Score
10/10
Malware Config
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 1 IoCs
- Chaos family
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderv5.2.exe"C:\Users\Admin\AppData\Local\Temp\ChaosRansomwareBuilderv5.2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4920-0-0x00007FFE0B013000-0x00007FFE0B015000-memory.dmp
memory/4920-1-0x0000000000950000-0x00000000009E0000-memory.dmp
memory/4920-2-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp
memory/4920-3-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp
memory/4920-4-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp