Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
04-05-2024 04:48
General
-
Target
2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe
-
Size
86KB
-
MD5
8f127c103c5c42664521a9be296a587a
-
SHA1
c6749246a83f5a63b9e1a4516e6810fc7ecd28e0
-
SHA256
cac286e52563a7892d233c1497496594fe50aa8fb4ad73a9def0eb8c351b742d
-
SHA512
ff895ef8a9fa1d7637fb4f7b3a31b8537f5c0238a38f1fc710650e38a12a6a769f303bf89a48cb82d0a60a9e31c32aed1bd568f18cf0c090c8d936d1b5dd5ff2
-
SSDEEP
1536:fo2scar9wKkrJOzzzzzzzzzzzzzfmzzzzzzzzzzl3C8GeGlzzzzzzzNlzzzzzzzy:foPcar9wx9CkGrdmQklQVrU
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
-
Detects command variations typically used by ransomware 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_8f127c103c5c42664521a9be296a587a_destroyer_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\read_it.txtFilesize
94B
MD5df43b8b8d34e947ec116088fa465702a
SHA1c145482bf4a7eff15f30617e93b1b4831be1fb30
SHA2564c3808e41dae9349f472e6cbc8e41c17d12a7b6727cfca9bc941ff0d0b5b6982
SHA512ac527673757e14ab47ae241e752163915cadbd43983aff56b5da6f38fd29b7940e2906c216f914b2bf541945ebaa0262271d8a927cf96d6bd075e00b936901dc
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
86KB
MD58f127c103c5c42664521a9be296a587a
SHA1c6749246a83f5a63b9e1a4516e6810fc7ecd28e0
SHA256cac286e52563a7892d233c1497496594fe50aa8fb4ad73a9def0eb8c351b742d
SHA512ff895ef8a9fa1d7637fb4f7b3a31b8537f5c0238a38f1fc710650e38a12a6a769f303bf89a48cb82d0a60a9e31c32aed1bd568f18cf0c090c8d936d1b5dd5ff2
-
memory/4224-14-0x00007FF825A10000-0x00007FF8264D1000-memory.dmpFilesize
10.8MB
-
memory/4224-27-0x00007FF825A10000-0x00007FF8264D1000-memory.dmpFilesize
10.8MB
-
memory/4748-0-0x00007FF825A13000-0x00007FF825A15000-memory.dmpFilesize
8KB
-
memory/4748-1-0x0000000000360000-0x000000000037C000-memory.dmpFilesize
112KB