Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/03/2024, 19:27
Behavioral task
behavioral1
Sample
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
-
Size
90KB
-
MD5
68a7df17272b831cfc66c1032c32facf
-
SHA1
dea12fb894f88ed6c905ca56b424252909d91c24
-
SHA256
4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d
-
SHA512
d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25
-
SSDEEP
384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN
Malware Config
Extracted
C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt
https://www.coinmama.com
https://www.bitpanda.com
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral1/memory/2304-0-0x0000000000170000-0x000000000018C000-memory.dmp family_chaos behavioral1/files/0x000d00000001224d-5.dat family_chaos behavioral1/memory/1612-7-0x0000000000DB0000-0x0000000000DCC000-memory.dmp family_chaos -
Detects command variations typically used by ransomware 3 IoCs
resource yara_rule behavioral1/memory/2304-0-0x0000000000170000-0x000000000018C000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x000d00000001224d-5.dat INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/1612-7-0x0000000000DB0000-0x0000000000DCC000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\READ ME FOR AN EXPLAINETION.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1612 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1612 svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe 1612 svchost.exe 1612 svchost.exe 1612 svchost.exe 1612 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe Token: SeDebugPrivilege 1612 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2304 wrote to memory of 1612 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe 28 PID 2304 wrote to memory of 1612 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe 28 PID 2304 wrote to memory of 1612 2304 2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe 28 PID 1612 wrote to memory of 2196 1612 svchost.exe 29 PID 1612 wrote to memory of 2196 1612 svchost.exe 29 PID 1612 wrote to memory of 2196 1612 svchost.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\READ ME FOR AN EXPLAINETION.txt3⤵PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD568a7df17272b831cfc66c1032c32facf
SHA1dea12fb894f88ed6c905ca56b424252909d91c24
SHA2564f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d
SHA512d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25
-
Filesize
1KB
MD543779c2e45e690a7725dec568068513e
SHA19e89a34b8d270788c4b690348563d83ac17436ea
SHA2564593281a0ce90b519b799ac1d04af6643a0ba37b7cef27aad16ee9dead959545
SHA51260aed98583262f3f44b845b73bdf13b5db19e8020a4dc28aa2196ff9762e2320c9260c0034768e29136a92200b1f8b6739e76fcdb905dfca03ea0a52ee326d58