Malware Analysis Report

2025-04-13 21:18

Sample ID 250322-2vv62aswev
Target Chaos Ransomware Builder v4.exe
SHA256 f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
Tags
chaos ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

Threat Level: Known bad

The file Chaos Ransomware Builder v4.exe was found to be: Known bad.

Malicious Activity Summary

chaos ransomware spyware stealer

Chaos Ransomware

Chaos

Chaos family

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Drops desktop.ini file(s)

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-22 22:54

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-22 22:54

Reported

2025-03-22 22:57

Platform

win11-20250314-en

Max time kernel

149s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Chaos family

chaos

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Azera Spoofer.url C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3920535620-1286624088-2946613906-1000\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \Registry\User\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\NotificationData C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
N/A N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Azera Spoofer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe

"C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzw4hw02\dzw4hw02.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES995D.tmp" "c:\Users\Admin\Desktop\CSCC5855C0F578847B8A792E68995892451.TMP"

C:\Users\Admin\Desktop\Azera Spoofer.exe

"C:\Users\Admin\Desktop\Azera Spoofer.exe"

C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe

"C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeEdit.M2T"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\Desktop\Azera Spoofer.exe

"C:\Users\Admin\Desktop\Azera Spoofer.exe"

C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe

"C:\Users\Admin\AppData\Roaming\Azera Spoofer.exe"

Network

Country Destination Domain Proto
IE 52.111.236.22:443 tcp

Files

memory/2488-0-0x00007FFF91F93000-0x00007FFF91F95000-memory.dmp

memory/2488-1-0x0000000000910000-0x000000000099E000-memory.dmp

memory/2488-2-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-3-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-4-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-5-0x00007FFF91F93000-0x00007FFF91F95000-memory.dmp

memory/2488-6-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-7-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-8-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-9-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

memory/2488-10-0x00007FFF91F90000-0x00007FFF92A52000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\dzw4hw02\dzw4hw02.cmdline

MD5 9ac0e6e00e316100c8f4718a8b7596e3
SHA1 4ee2f9137aeb5b6a2f59e6493fffa1fc860187ba
SHA256 1534c411b73c87485fbde68d1e37ceb12893c4deb5e1057e47cd7c7e7ff7fe1e
SHA512 ac5704a84d913833f78b9a3fb62313731f0e647f979cbc193e39fda70dce042b032f74ff831c44cfee2cb40aa0d52a6c78527ee873a6e6dc7fe11cc63e897549

\??\c:\Users\Admin\AppData\Local\Temp\dzw4hw02\dzw4hw02.0.cs

MD5 aedfa941025c3bbcc512d122660fab00
SHA1 27370a8a713c5de0872b3951fb5e857e47ebc20a
SHA256 f2142bbef1dd90e46519ab107919c357f5b90e8f263ba25c14fe6b6fb00e83b7
SHA512 2b517767f613bc7c08ab30798ae11e24f2b3805f9f51c4d3db91c4c06d67aaa483bab2b7136d69fe42133c0ca909122cb54ae812f2c936b46e25d97d670042f7

\??\c:\Users\Admin\Desktop\CSCC5855C0F578847B8A792E68995892451.TMP

MD5 64c760b6d85efe189ee6c0a4a007194b
SHA1 c41596f65dac164760424220752d1ed5bf0f90d8
SHA256 d8cbba8e0d46d4b1251a999de5b71e40238c3494c48746dc2cc66b386b563ad6
SHA512 fab48100cd9e08749091baf645469e5cb0644acb4a913c1368a55893cccd3a937e557930fbc7b74f4ed54d38faaf0f6f1e9e6df46c4029b3780b9970967fd5f2

C:\Users\Admin\AppData\Local\Temp\RES995D.tmp

MD5 8dbf8f8ce7d9be8beda22ebd09803edc
SHA1 201b61aec06fdb8bfbd26f35375ada839e8fa09c
SHA256 204c1942040cd168aea555f10cbd64cd2ec06b2f41e45dd835214e3d19d5d3cc
SHA512 1ae5db90bd51d617c5b2e40b95e08ee48429e2b1a880bc6eeb9d997d5b151437282239433a812c9f5fc9f046dcc92190a9d3f09b259a1face3351e5386d04bd3

C:\Users\Admin\Desktop\Azera Spoofer.exe

MD5 a9253d775b8f1855787f6933f5133397
SHA1 89de2768f4b17c30a184e7a1856266a5252c0fae
SHA256 bc1e9c244bbfc653c4a54dfb967188cbbdf5fe7f27bd9c3cf3b6792f19896d17
SHA512 dfc57074e8fa34972833d3445f6c35ae3caa82f356f5244b7ed959824dcee911dacb80ec23b17b89e8b7bd5c315d3b9f1f91c9e8671dd0dfbb1f4b98fc77dc20

memory/6132-25-0x0000000000410000-0x000000000041C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Azera Spoofer.exe.log

MD5 4ae344179932dc8e2c6fe2079f9753ef
SHA1 60eacc624412b1f34809780769e3b212f138ea9c
SHA256 3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4
SHA512 fadfe2b83f1af8fdc50430325f69d6172d2c1e889ca3800b3b83e5535d5970c32e9a176b48563275a0630d56c96d9f88df148fd6b2d281f0fc58129e5f4dba19

C:\Users\Admin\Desktop\read_it.txt

MD5 4217b8b83ce3c3f70029a056546f8fd0
SHA1 487cdb5733d073a0427418888e8f7070fe782a03
SHA256 7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121
SHA512 2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

memory/3160-111-0x00007FFF9E7C0000-0x00007FFF9E7F4000-memory.dmp

memory/3160-110-0x00007FF7002D0000-0x00007FF7003C8000-memory.dmp

memory/3160-112-0x00007FFF8C0A0000-0x00007FFF8C356000-memory.dmp

memory/3160-113-0x00007FFF8ABB0000-0x00007FFF8BC60000-memory.dmp