Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 19:40
Behavioral task
behavioral1
Sample
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe
-
Size
23KB
-
MD5
93380c107beb90834526bbb0aed3c797
-
SHA1
ca75cd68ec67645802ebd6b0385a4e51c5a56b9b
-
SHA256
704f4354e2156b8cff3439fb09f8f2aa68abb9d1d702981062b4946653b832b4
-
SHA512
061ef3f32bc166bafa9c1e37991dd62634747e6fe294b3e93053d3193ee1e845d7320451206fe2762b373346bc30ea911c405179eb71e531baaed62e1740dc32
-
SSDEEP
384:u3MLWHn3kIjf7SxlR24p1SOGy5JRSr91Crxb51eV:Sn3kIP6Pp1IyXwr9SxbDeV
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000E90000-0x0000000000E9C000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000E90000-0x0000000000E9C000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware C:\Users\Admin\AppData\Roaming\svchost.exe INDICATOR_SUSPICIOUS_GENRansomware -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 344 bcdedit.exe 2312 bcdedit.exe -
Processes:
wbadmin.exepid process 628 wbadmin.exe -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2004 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2436 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 488 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2004 svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exesvchost.exepid process 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe 2004 svchost.exe 2004 svchost.exe 2004 svchost.exe 2004 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exesvchost.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe Token: SeDebugPrivilege 2004 svchost.exe Token: SeBackupPrivilege 804 vssvc.exe Token: SeRestorePrivilege 804 vssvc.exe Token: SeAuditPrivilege 804 vssvc.exe Token: SeIncreaseQuotaPrivilege 2396 WMIC.exe Token: SeSecurityPrivilege 2396 WMIC.exe Token: SeTakeOwnershipPrivilege 2396 WMIC.exe Token: SeLoadDriverPrivilege 2396 WMIC.exe Token: SeSystemProfilePrivilege 2396 WMIC.exe Token: SeSystemtimePrivilege 2396 WMIC.exe Token: SeProfSingleProcessPrivilege 2396 WMIC.exe Token: SeIncBasePriorityPrivilege 2396 WMIC.exe Token: SeCreatePagefilePrivilege 2396 WMIC.exe Token: SeBackupPrivilege 2396 WMIC.exe Token: SeRestorePrivilege 2396 WMIC.exe Token: SeShutdownPrivilege 2396 WMIC.exe Token: SeDebugPrivilege 2396 WMIC.exe Token: SeSystemEnvironmentPrivilege 2396 WMIC.exe Token: SeRemoteShutdownPrivilege 2396 WMIC.exe Token: SeUndockPrivilege 2396 WMIC.exe Token: SeManageVolumePrivilege 2396 WMIC.exe Token: 33 2396 WMIC.exe Token: 34 2396 WMIC.exe Token: 35 2396 WMIC.exe Token: SeIncreaseQuotaPrivilege 2396 WMIC.exe Token: SeSecurityPrivilege 2396 WMIC.exe Token: SeTakeOwnershipPrivilege 2396 WMIC.exe Token: SeLoadDriverPrivilege 2396 WMIC.exe Token: SeSystemProfilePrivilege 2396 WMIC.exe Token: SeSystemtimePrivilege 2396 WMIC.exe Token: SeProfSingleProcessPrivilege 2396 WMIC.exe Token: SeIncBasePriorityPrivilege 2396 WMIC.exe Token: SeCreatePagefilePrivilege 2396 WMIC.exe Token: SeBackupPrivilege 2396 WMIC.exe Token: SeRestorePrivilege 2396 WMIC.exe Token: SeShutdownPrivilege 2396 WMIC.exe Token: SeDebugPrivilege 2396 WMIC.exe Token: SeSystemEnvironmentPrivilege 2396 WMIC.exe Token: SeRemoteShutdownPrivilege 2396 WMIC.exe Token: SeUndockPrivilege 2396 WMIC.exe Token: SeManageVolumePrivilege 2396 WMIC.exe Token: 33 2396 WMIC.exe Token: 34 2396 WMIC.exe Token: 35 2396 WMIC.exe Token: SeBackupPrivilege 1264 wbengine.exe Token: SeRestorePrivilege 1264 wbengine.exe Token: SeSecurityPrivilege 1264 wbengine.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exesvchost.execmd.execmd.execmd.exedescription pid process target process PID 2924 wrote to memory of 2004 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe svchost.exe PID 2924 wrote to memory of 2004 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe svchost.exe PID 2924 wrote to memory of 2004 2924 2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe svchost.exe PID 2004 wrote to memory of 2476 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 2476 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 2476 2004 svchost.exe cmd.exe PID 2476 wrote to memory of 2436 2476 cmd.exe vssadmin.exe PID 2476 wrote to memory of 2436 2476 cmd.exe vssadmin.exe PID 2476 wrote to memory of 2436 2476 cmd.exe vssadmin.exe PID 2476 wrote to memory of 2396 2476 cmd.exe WMIC.exe PID 2476 wrote to memory of 2396 2476 cmd.exe WMIC.exe PID 2476 wrote to memory of 2396 2476 cmd.exe WMIC.exe PID 2004 wrote to memory of 2764 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 2764 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 2764 2004 svchost.exe cmd.exe PID 2764 wrote to memory of 344 2764 cmd.exe bcdedit.exe PID 2764 wrote to memory of 344 2764 cmd.exe bcdedit.exe PID 2764 wrote to memory of 344 2764 cmd.exe bcdedit.exe PID 2764 wrote to memory of 2312 2764 cmd.exe bcdedit.exe PID 2764 wrote to memory of 2312 2764 cmd.exe bcdedit.exe PID 2764 wrote to memory of 2312 2764 cmd.exe bcdedit.exe PID 2004 wrote to memory of 1812 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 1812 2004 svchost.exe cmd.exe PID 2004 wrote to memory of 1812 2004 svchost.exe cmd.exe PID 1812 wrote to memory of 628 1812 cmd.exe wbadmin.exe PID 1812 wrote to memory of 628 1812 cmd.exe wbadmin.exe PID 1812 wrote to memory of 628 1812 cmd.exe wbadmin.exe PID 2004 wrote to memory of 488 2004 svchost.exe NOTEPAD.EXE PID 2004 wrote to memory of 488 2004 svchost.exe NOTEPAD.EXE PID 2004 wrote to memory of 488 2004 svchost.exe NOTEPAD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_93380c107beb90834526bbb0aed3c797_chaos_destroyer_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2436 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:344 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:628 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:488
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:804
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2772
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD593380c107beb90834526bbb0aed3c797
SHA1ca75cd68ec67645802ebd6b0385a4e51c5a56b9b
SHA256704f4354e2156b8cff3439fb09f8f2aa68abb9d1d702981062b4946653b832b4
SHA512061ef3f32bc166bafa9c1e37991dd62634747e6fe294b3e93053d3193ee1e845d7320451206fe2762b373346bc30ea911c405179eb71e531baaed62e1740dc32
-
Filesize
964B
MD54217b8b83ce3c3f70029a056546f8fd0
SHA1487cdb5733d073a0427418888e8f7070fe782a03
SHA2567d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121
SHA5122a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740