Overview

overview

10

Static

static

10

built.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250217-fr
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250217-frlocale:fr-fros:windows10-ltsc 2021-x64systemwindows
  • submitted
    20-02-2025 19:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    built.exe

  • Size

    280KB

  • MD5

    ce2de0ede14e0b143ac05634799fea77

  • SHA1

    d466b46837a9af03b9c503bccf6d8b97c5ec9d9b

  • SHA256

    48719bdc85157f9911c11709e6fd50e4f57b58a6a9e34ddc2084883d2c04c77a

  • SHA512

    cf6afcb1da1020aa1221cac9dc91197ae4e5f41c3d29bb386a7e6849f61f7b198d82f4c9dd9d5a428aed3d54e592796d960b893a4243d734332a712af6688624

  • SSDEEP

    6144:Cc9pXH6pTJIIczuVf2Qpm7U5jX/KBTvdwFyWKSL4/gCiH:LH6pTJ3c6Vf2QpmINX/KBTvdwFrKSL4S

Score
10/10
chaosdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 63 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\built.exe
    "C:\Users\Admin\AppData\Local\Temp\built.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:2904
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3528
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3544
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3516
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1608
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:2772
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2408
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2628
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:3264
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1908
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:240
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:228
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:4344
    • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1380
    • C:\Windows\System32\SecurityHealthHost.exe
      C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
      1⤵
        PID:756
      • C:\Windows\System32\SecurityHealthHost.exe
        C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
        1⤵
          PID:3656
        • C:\Windows\System32\SecurityHealthHost.exe
          C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
          1⤵
            PID:1844
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:2712
            • C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
              "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
              1⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:2288
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2448
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 27A70664269AE2230FCA7E937A9B13D3
                2⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                PID:1172

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\built.exe.log
              Filesize

              226B

              MD5

              b92bd19c1a9416298a873dfa43b439b7

              SHA1

              7b96a8874aff3a502363f4168332613ebc53d64e

              SHA256

              1ac8854abd01c202cf82e4ccdf80bf50319c59bc7a02dce2b19cecfedf7dd4ba

              SHA512

              5910691ebdd78a2740117b14f146629874682d196f518f479b8bcb754ed2501a009fc465cb9e3685f7aed8ced7b435690de2b8b8439117abb5f61dc4996387a6

              Download Submit

            • C:\Users\Admin\AppData\Local\read_it.txt
              Filesize

              20B

              MD5

              43492e7c86992f9200ce43c52129e5e2

              SHA1

              39ab84971a5143a2a8b893f14c8e2d2c0d300780

              SHA256

              53d7cafcf33472cc7b3f0545f80feaab04c868cd5617f92e15a5c5c88e92c691

              SHA512

              dfd525a3b4691148ba8fba7e1d1cae9199026f141bd6ef63464a4990d61a690ebab33df85a6076970a564686d7f79d0e0343792fd3a81b6bd79bce75ec4a03a4

              Download Submit

            • C:\Users\Admin\AppData\Roaming\DisableUse.svgz
              Filesize

              1B

              MD5

              d1457b72c3fb323a2671125aef3eab5d

              SHA1

              5bab61eb53176449e25c2c82f172b82cb13ffb9d

              SHA256

              8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

              SHA512

              ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

              Download Submit

            • C:\Users\Admin\AppData\Roaming\svchost.exe
              Filesize

              280KB

              MD5

              ce2de0ede14e0b143ac05634799fea77

              SHA1

              d466b46837a9af03b9c503bccf6d8b97c5ec9d9b

              SHA256

              48719bdc85157f9911c11709e6fd50e4f57b58a6a9e34ddc2084883d2c04c77a

              SHA512

              cf6afcb1da1020aa1221cac9dc91197ae4e5f41c3d29bb386a7e6849f61f7b198d82f4c9dd9d5a428aed3d54e592796d960b893a4243d734332a712af6688624

              Download Submit

            • C:\Windows\Installer\MSI92BC.tmp
              Filesize

              57KB

              MD5

              c23d4d5a87e08f8a822ad5a8dbd69592

              SHA1

              317df555bc309dace46ae5c5589bec53ea8f137e

              SHA256

              6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27

              SHA512

              fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b

              Download Submit

            • C:\Windows\Installer\MSI9463.tmp
              Filesize

              418KB

              MD5

              67f23a38c85856e8a20e815c548cd424

              SHA1

              16e8959c52f983e83f688f4cce3487364b1ffd10

              SHA256

              f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

              SHA512

              41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

              Download Submit

            • C:\Windows\Installer\MSI94F1.tmp
              Filesize

              148KB

              MD5

              be0b6bea2e4e12bf5d966c6f74fa79b5

              SHA1

              8468ec23f0a30065eee6913bf8eba62dd79651ec

              SHA256

              6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

              SHA512

              dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

              Download Submit

            • C:\Windows\Installer\MSI958F.tmp
              Filesize

              209KB

              MD5

              0e91605ee2395145d077adb643609085

              SHA1

              303263aa6889013ce889bd4ea0324acdf35f29f2

              SHA256

              5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

              SHA512

              3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

              Download Submit

            • memory/1044-5-0x00007FFC426F0000-0x00007FFC431B2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/1044-12-0x000000001D540000-0x000000001D642000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1044-1299-0x00007FFC426F0000-0x00007FFC431B2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/1808-2-0x000000001B8E0000-0x000000001B922000-memory.dmp

              Filesize

              264KB

              Download

            • memory/1808-1-0x0000000000950000-0x000000000099C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1808-0-0x00007FFC426F3000-0x00007FFC426F5000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2288-1305-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1309-0x00007FFC1E6F0000-0x00007FFC1E700000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1310-0x00007FFC1E6F0000-0x00007FFC1E700000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1329-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1332-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1331-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1330-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1308-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1307-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1304-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2288-1306-0x00007FFC21010000-0x00007FFC21020000-memory.dmp

              Filesize

              64KB

              Download