Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 05:36
Behavioral task
behavioral1
Sample
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe
-
Size
22KB
-
MD5
d0cf727c46e2ee5dbf57063d3ae85dfd
-
SHA1
e5fab1e8a3954970331f415e5bcb7cdc2ad678d3
-
SHA256
93e27f3c219edee9e18c570fc1b36c0fae0e3b06cbbe85bd9afb4fe7d11d03ea
-
SHA512
da7b19ec144f69594d66b46c5e24adeccbd4bd2d13bc04be4030f4464978f2d8263dcfffe9392d684ecd5d918366d5c6236e39a9d47be18e4b166091448fc326
-
SSDEEP
384:p3MLWHn3kITf5o1CWpW23+rJVr91CrNveg:Jn3kIhWpW2CVr9Sxeg
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-0-0x0000000001120000-0x000000000112C000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos behavioral1/memory/2484-7-0x0000000000370000-0x000000000037C000-memory.dmp family_chaos -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-0-0x0000000001120000-0x000000000112C000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware C:\Users\Admin\AppData\Roaming\svchost.exe INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2484-7-0x0000000000370000-0x000000000037C000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1844 bcdedit.exe 2116 bcdedit.exe -
Processes:
wbadmin.exepid process 2004 wbadmin.exe -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wifi_pass_wire svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2484 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2112 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2484 svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exesvchost.exepid process 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1004 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exesvchost.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe Token: SeDebugPrivilege 2484 svchost.exe Token: SeBackupPrivilege 2204 vssvc.exe Token: SeRestorePrivilege 2204 vssvc.exe Token: SeAuditPrivilege 2204 vssvc.exe Token: SeIncreaseQuotaPrivilege 2940 WMIC.exe Token: SeSecurityPrivilege 2940 WMIC.exe Token: SeTakeOwnershipPrivilege 2940 WMIC.exe Token: SeLoadDriverPrivilege 2940 WMIC.exe Token: SeSystemProfilePrivilege 2940 WMIC.exe Token: SeSystemtimePrivilege 2940 WMIC.exe Token: SeProfSingleProcessPrivilege 2940 WMIC.exe Token: SeIncBasePriorityPrivilege 2940 WMIC.exe Token: SeCreatePagefilePrivilege 2940 WMIC.exe Token: SeBackupPrivilege 2940 WMIC.exe Token: SeRestorePrivilege 2940 WMIC.exe Token: SeShutdownPrivilege 2940 WMIC.exe Token: SeDebugPrivilege 2940 WMIC.exe Token: SeSystemEnvironmentPrivilege 2940 WMIC.exe Token: SeRemoteShutdownPrivilege 2940 WMIC.exe Token: SeUndockPrivilege 2940 WMIC.exe Token: SeManageVolumePrivilege 2940 WMIC.exe Token: 33 2940 WMIC.exe Token: 34 2940 WMIC.exe Token: 35 2940 WMIC.exe Token: SeIncreaseQuotaPrivilege 2940 WMIC.exe Token: SeSecurityPrivilege 2940 WMIC.exe Token: SeTakeOwnershipPrivilege 2940 WMIC.exe Token: SeLoadDriverPrivilege 2940 WMIC.exe Token: SeSystemProfilePrivilege 2940 WMIC.exe Token: SeSystemtimePrivilege 2940 WMIC.exe Token: SeProfSingleProcessPrivilege 2940 WMIC.exe Token: SeIncBasePriorityPrivilege 2940 WMIC.exe Token: SeCreatePagefilePrivilege 2940 WMIC.exe Token: SeBackupPrivilege 2940 WMIC.exe Token: SeRestorePrivilege 2940 WMIC.exe Token: SeShutdownPrivilege 2940 WMIC.exe Token: SeDebugPrivilege 2940 WMIC.exe Token: SeSystemEnvironmentPrivilege 2940 WMIC.exe Token: SeRemoteShutdownPrivilege 2940 WMIC.exe Token: SeUndockPrivilege 2940 WMIC.exe Token: SeManageVolumePrivilege 2940 WMIC.exe Token: 33 2940 WMIC.exe Token: 34 2940 WMIC.exe Token: 35 2940 WMIC.exe Token: SeBackupPrivilege 1828 wbengine.exe Token: SeRestorePrivilege 1828 wbengine.exe Token: SeSecurityPrivilege 1828 wbengine.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 1004 AcroRd32.exe 1004 AcroRd32.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exesvchost.execmd.execmd.execmd.exerundll32.exedescription pid process target process PID 2952 wrote to memory of 2484 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe svchost.exe PID 2952 wrote to memory of 2484 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe svchost.exe PID 2952 wrote to memory of 2484 2952 2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe svchost.exe PID 2484 wrote to memory of 2868 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2868 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2868 2484 svchost.exe cmd.exe PID 2868 wrote to memory of 2112 2868 cmd.exe vssadmin.exe PID 2868 wrote to memory of 2112 2868 cmd.exe vssadmin.exe PID 2868 wrote to memory of 2112 2868 cmd.exe vssadmin.exe PID 2868 wrote to memory of 2940 2868 cmd.exe WMIC.exe PID 2868 wrote to memory of 2940 2868 cmd.exe WMIC.exe PID 2868 wrote to memory of 2940 2868 cmd.exe WMIC.exe PID 2484 wrote to memory of 2248 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2248 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2248 2484 svchost.exe cmd.exe PID 2248 wrote to memory of 1844 2248 cmd.exe bcdedit.exe PID 2248 wrote to memory of 1844 2248 cmd.exe bcdedit.exe PID 2248 wrote to memory of 1844 2248 cmd.exe bcdedit.exe PID 2248 wrote to memory of 2116 2248 cmd.exe bcdedit.exe PID 2248 wrote to memory of 2116 2248 cmd.exe bcdedit.exe PID 2248 wrote to memory of 2116 2248 cmd.exe bcdedit.exe PID 2484 wrote to memory of 2236 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2236 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 2236 2484 svchost.exe cmd.exe PID 2236 wrote to memory of 2004 2236 cmd.exe wbadmin.exe PID 2236 wrote to memory of 2004 2236 cmd.exe wbadmin.exe PID 2236 wrote to memory of 2004 2236 cmd.exe wbadmin.exe PID 2484 wrote to memory of 1496 2484 svchost.exe rundll32.exe PID 2484 wrote to memory of 1496 2484 svchost.exe rundll32.exe PID 2484 wrote to memory of 1496 2484 svchost.exe rundll32.exe PID 1496 wrote to memory of 1004 1496 rundll32.exe AcroRd32.exe PID 1496 wrote to memory of 1004 1496 rundll32.exe AcroRd32.exe PID 1496 wrote to memory of 1004 1496 rundll32.exe AcroRd32.exe PID 1496 wrote to memory of 1004 1496 rundll32.exe AcroRd32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_d0cf727c46e2ee5dbf57063d3ae85dfd_destroyer_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Wifi_pass_wire3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Wifi_pass_wire"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5c8ef73697066c7f58aa1f2b60bc89d97
SHA1b20ed7c6f8ac6c1382db135ada2b268c76019085
SHA256dc438137e049df578b7285105ff97de8f64d9b10fcb9bea96698152cd7aacf33
SHA5120b65d3c6250d9e24b4821423f04dd48d71e54cc558a17f5698cf535c595f2dc2bcfb80eb7752de7f6b6e12dfa9d5b4250e2d3de805908e9fc5adab235a8af81d
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
22KB
MD5d0cf727c46e2ee5dbf57063d3ae85dfd
SHA1e5fab1e8a3954970331f415e5bcb7cdc2ad678d3
SHA25693e27f3c219edee9e18c570fc1b36c0fae0e3b06cbbe85bd9afb4fe7d11d03ea
SHA512da7b19ec144f69594d66b46c5e24adeccbd4bd2d13bc04be4030f4464978f2d8263dcfffe9392d684ecd5d918366d5c6236e39a9d47be18e4b166091448fc326
-
C:\Users\Admin\Desktop\Wifi_pass_wireFilesize
605B
MD5a411951ff9b7937383e1b22fb21933a1
SHA177e1ecf2a0b716a8a662a9f51be8db019acc3130
SHA256669cdc2df83b48699813a1087c2662f0449f1a27d9a214e8a688435bfb3c4f93
SHA512cc04656f91185ec8be78479554fdc0f5de2e8302c0a5023aa80814c692e8d85b7ed969300ffe872be230391248e2ca756c6bf769a3f520b68826b4c1ca1e6754
-
memory/2484-7-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/2484-9-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmpFilesize
9.9MB
-
memory/2484-73-0x000000001AE20000-0x000000001AEA0000-memory.dmpFilesize
512KB
-
memory/2484-92-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmpFilesize
9.9MB
-
memory/2484-93-0x000000001AE20000-0x000000001AEA0000-memory.dmpFilesize
512KB
-
memory/2952-0-0x0000000001120000-0x000000000112C000-memory.dmpFilesize
48KB
-
memory/2952-1-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmpFilesize
9.9MB
-
memory/2952-8-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmpFilesize
9.9MB