Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/03/2024, 19:27

General

  • Target

    2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe

  • Size

    90KB

  • MD5

    68a7df17272b831cfc66c1032c32facf

  • SHA1

    dea12fb894f88ed6c905ca56b424252909d91c24

  • SHA256

    4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d

  • SHA512

    d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25

  • SSDEEP

    384:j3MLWHn3kIUHHOppIUs4IJ4r91CzCCr19e4p/1BpfaFxpbyOHh0f:Pn3kIGOppIUsJ4r9i5rDe4zXaN

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt

Ransom Note
All of your files have been encrypted. Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help. What can I do to get my files back? You can buy our special decryption software. This software will allow you to recover all of your data and remove the ransomware from your computer. The price for the software is $50. Payment can be made in Bitcoin (Bitcoin Address: bc1qakhl8eu20ely220fxm6d3tjsk2al64vrha4sxa), Ethereum (ETH Address: 0x22D2C1C38b3c26C9E403B34ea5aF42Af00e90d9f), Binance Coin (BNB Address: bnb17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV0205gfc6ykk), or through PayPal (Burner Account: [email protected]). You can make the payment directly by visiting this PayPal site: PayPal Payment Site. How do I pay, where do I get Bitcoin, Ethereum, Binance Coin, or PayPal? Purchasing Bitcoin, Ethereum, or Binance Coin varies from country to country, you are best advised to do a quick Google search yourself to find out how to buy Bitcoin, Ethereum, Binance Coin, or set up a PayPal account. These sites will help you to get fast and reliable Bitcoin, Ethereum, Binance Coin, or PayPal. Coinmama - https://www.coinmama.com Bitpanda - https://www.bitpanda.com If you will try to seek for help or advice we recommend not to. Why you ask? Because no other software can decrypt this ransomware, only us have the special key to unlock it. So getting other decrypters will be worthless. Don't even think about calling the cops; we will snitch about your pedo activity! You have exactly 12 hours from now to pay up or your PC will be locked for a very long time, approximately 125 Years! Have fun buddy. We monitor every move you make, 👁️‍🗨️ with 8 eyes on you, always one step ahead 👁️, lurking in your devices.
URLs

https://www.coinmama.com

https://www.bitpanda.com

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 3 IoCs
  • Detects command variations typically used by ransomware 3 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-23_68a7df17272b831cfc66c1032c32facf_destroyer_wannacry.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\READ ME FOR AN EXPLAINETION.txt
        3⤵
          PID:2196

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      90KB

      MD5

      68a7df17272b831cfc66c1032c32facf

      SHA1

      dea12fb894f88ed6c905ca56b424252909d91c24

      SHA256

      4f08c19447c00c39129518e6694bd1780174912b39327f5468e8523a2e423e5d

      SHA512

      d555da23a9b1fa25988afb6c530de2d15f6a3494603e43d220a35f1c605c2537287daf5a6876360fdec83e41ab5d876f6dbac06c25e896ac5902fc9b85f3ea25

    • C:\Users\Admin\Desktop\READ ME FOR AN EXPLAINETION.txt

      Filesize

      1KB

      MD5

      43779c2e45e690a7725dec568068513e

      SHA1

      9e89a34b8d270788c4b690348563d83ac17436ea

      SHA256

      4593281a0ce90b519b799ac1d04af6643a0ba37b7cef27aad16ee9dead959545

      SHA512

      60aed98583262f3f44b845b73bdf13b5db19e8020a4dc28aa2196ff9762e2320c9260c0034768e29136a92200b1f8b6739e76fcdb905dfca03ea0a52ee326d58

    • memory/1612-7-0x0000000000DB0000-0x0000000000DCC000-memory.dmp

      Filesize

      112KB

    • memory/1612-9-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB

    • memory/1612-69-0x0000000000D30000-0x0000000000DB0000-memory.dmp

      Filesize

      512KB

    • memory/1612-71-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB

    • memory/1612-72-0x0000000000D30000-0x0000000000DB0000-memory.dmp

      Filesize

      512KB

    • memory/2304-0-0x0000000000170000-0x000000000018C000-memory.dmp

      Filesize

      112KB

    • memory/2304-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2304-8-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB