Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows10-ltsc 2021-x64

10

Chaos Rans...v4.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/12/2024, 15:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 57 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kuue30ar\kuue30ar.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE30D.tmp" "c:\Users\Admin\Desktop\CSC42FBFDC1A0E54EE6A19AB527708C6540.TMP"
        3⤵
          PID:4532
    • C:\Users\Admin\Desktop\123.exe
      "C:\Users\Admin\Desktop\123.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:248
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:3140

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESE30D.tmp
      Filesize

      1KB

      MD5

      395b0d542c0040215770173e8673c71f

      SHA1

      e2c024c4c8c25711d1735f430b482a3dd5155a64

      SHA256

      7a83c0e8fee2b7bf40cc413609706fa381d67fedc93bc092c507d925ac4a1b07

      SHA512

      188c53783ddce76f1471717d2c5379647e906479bb35ebbe48c01ee79f608de34acd833ad1d6d74dc2dce4c9d593bddd8b4c86127a928ddc24741076a719218c

      Download Submit

    • C:\Users\Admin\Desktop\123.exe
      Filesize

      21KB

      MD5

      3e08c6a6046359864f9b9ae20ecf386e

      SHA1

      26e4a9067c9f1fe867640b072860b7283cd32f84

      SHA256

      818e92554c0e817f8d31de30f81961ecf9ff23d2b8c2c5f253852f5de63a57e7

      SHA512

      6661d5568a22de97b2d4a26de9c8df9638b7255ea28738a0f1107d7303878c105b31ef8e1fe88dbf6c190046173e09fc750a282e31bbed668a908c4092f11eb9

      Download Submit

    • C:\Users\Admin\Desktop\read_it.txt
      Filesize

      8B

      MD5

      489af8f31a5c7a455eb58447bc18bcfc

      SHA1

      c104b12924586019a69bb1b8b80bffea1a3c5e3b

      SHA256

      510c5962491beb1c943242159169e89fe810947affbfd61a7d9b527aa13d4292

      SHA512

      6976f0bdcd85cae947907a77535ca83f2d1e77db9ac46136ceb47e4cc1600e2d93725ff744a90d488e079baec2ee7f5bc1bc10ddfcbc4c3546eca2f6f8458723

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\kuue30ar\kuue30ar.0.cs
      Filesize

      29KB

      MD5

      d4c0cfd2fb38ef6a48eef0eb9918ae5f

      SHA1

      2f7ad2c4c2668b1738dcea4fd9295c972aac164e

      SHA256

      07d700bb34d614fd43777ddf3f9c477781ace33785ecab06734f0f0e3e475853

      SHA512

      d0254957ddb252431d56a341dcf8346f48a70a33a46561c48a93d79ff233d50c7513670e885f7c14cffd5a949ab2263a90b02d870318e3c19b99afb1451e45ab

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\kuue30ar\kuue30ar.cmdline
      Filesize

      329B

      MD5

      0dc99c4c47f96d8a70e01a30995c57e0

      SHA1

      bc5bea3445b659eb8122bb8272f88efc0a65e117

      SHA256

      78132aa6c7625eeb8549d85ce2936b594c81dfb1fdf17f3cbafea78cb18479d3

      SHA512

      89ebf1be180f80f08408c307d48bbb51193298367be85c589ac6e4adefbafdf4623017f1a8d5144a6ab1b9b2dcdb55aded0e0dd7d8398764ddc911cc8cb60269

      Download Submit

    • \??\c:\Users\Admin\Desktop\CSC42FBFDC1A0E54EE6A19AB527708C6540.TMP
      Filesize

      1KB

      MD5

      5f836ebb68ad0971adf50d08a00fb498

      SHA1

      59ba6ae7f8c218bd8f340142e88d5129e52640de

      SHA256

      1f85819bb24593bbfcf03c85e593cc0081235562d0f761f766683659437cb763

      SHA512

      6c4ba6fbc594109f9286046e5deba323f8d25eb6806438e3db7a20e2adc57071c279e42b5d7b3452703bd5cfe01c20d098e66e0f6fffa414033e4be392a96c39

      Download Submit

    • memory/248-23-0x00000000002D0000-0x00000000002DC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4820-3-0x00007FF952210000-0x00007FF952CD2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4820-6-0x00007FF952210000-0x00007FF952CD2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4820-5-0x00007FF952213000-0x00007FF952215000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4820-4-0x00007FF952210000-0x00007FF952CD2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4820-20-0x00007FF952210000-0x00007FF952CD2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4820-0-0x00007FF952213000-0x00007FF952215000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4820-2-0x00007FF952210000-0x00007FF952CD2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4820-1-0x00000000000F0000-0x000000000017E000-memory.dmp

      Filesize

      568KB

      Download