Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-09-2024 12:34
Behavioral task
behavioral1
Sample
2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe
-
Size
32KB
-
MD5
f4546cd292db332bd3450843677a210a
-
SHA1
e933a17670e7ccf12bd74940f1b28e484be890a3
-
SHA256
a34420684f2cac84d72ed9ce886e22327e8d316cb13b177076b6eac639149499
-
SHA512
217703a0b55c7e2923bb5b659c489141ec8d96ae97eaa423d9881eb4fdbd31b5913c5ee3813e513f60ec0da37c826295517acca293edab153cff11df47a2c604
-
SSDEEP
384:sYenjLLA+rjoA71WcA0OZz89Zdi+tYSx4EOVp91iNgoF2lfpV1FxDGp:rwcAZmo9Ztc9wSoF2dxDW
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read.txt
Ransom Note
Все ваши файлы зашифрованы.
На ваш компьютер попал вирус шифровальщик, и зашифровал все важные файлы.
Ваши файлы зашифрованы, и вы не сможете их расшифровать без нашей помощи,
так как только у нас есть дешифратор и специальный ключ расшифровки
Но не стоит отчаиваться, у нас есть специальный расшифровщиик файлов,
и мы готовы вам его предоставить за небольшую сумму, 30 000 российских рублей
Наш дешифратор позволит вам восстановить все ваши данные на вашем компьютере.
Согласитесь что лучше оплатить наши услуги по расшифровки, чем потерять свои документы,
и нести убытки от простоя компьютера.
Нам нет смысла вас обманывать, вы нам оплачиваете, а мы высылаем вам программу для
расшифровки ваших файлов и инструкцию к ней.
До оплаты что бы убедится что мы можем расшифровать все ваши файлы, для теста можете
прислать любой небольшой зашифрованный файл,например, картинки (jpg, png,pdf, gif) или word (doc, docx)
в ответ в качестве доказательства вам мы вышлем расшифрованный файл.
Если вас интересует восстановление всех ваших файлов напишите для получения инструкций, узнать
как оплатить,и по другим вопросам на почту [email protected]
в теме письма укажите текст id4783630353418
All your files are encrypted.
A ransomware virus got onto your computer and encrypted all your important files.
Your files are encrypted and you will not be able to decrypt them without our help,
since only we have a decryptor and a special decryption key
But don’t despair, we have a special file decryptor,
and we are ready to provide it to you for a small amount, 30 000 russian rubles
Our decryptor will allow you to recover all your data on your computer.
Agree that it is better to pay for our decryption services than to lose your documents,
and incur losses from computer downtime.
There is no point in us deceiving you, you pay us, and we send you the program for
decryption of your files and instructions for it.
Before payment, to make sure that we can decrypt all your files, you can test
send any small encrypted file, for example, pictures (jpg, png, pdf, gif) or word (doc, docx)
In response, we will send you the decrypted file as proof.
If you are interested in recovering all your files, write to receive instructions, find out
how to pay, and for other questions, email [email protected]
in the subject of the letter indicate the text id4783630353418
Emails
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral1/memory/2252-1-0x00000000009C0000-0x00000000009CE000-memory.dmp family_chaos behavioral1/files/0x000b000000012257-5.dat family_chaos behavioral1/memory/2720-7-0x0000000000B40000-0x0000000000B4E000-memory.dmp family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1512 bcdedit.exe 2276 bcdedit.exe -
Renames multiple (179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2972 wbadmin.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2720 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GRU3FPRK\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYYHNCRR\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TL381H8Y\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MX1BY2FD\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YFS4OGJW\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\X9WSUL7T\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OBDG6J46\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 744 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2536 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2720 svchost.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe Token: SeDebugPrivilege 2720 svchost.exe Token: SeBackupPrivilege 2588 vssvc.exe Token: SeRestorePrivilege 2588 vssvc.exe Token: SeAuditPrivilege 2588 vssvc.exe Token: SeIncreaseQuotaPrivilege 428 WMIC.exe Token: SeSecurityPrivilege 428 WMIC.exe Token: SeTakeOwnershipPrivilege 428 WMIC.exe Token: SeLoadDriverPrivilege 428 WMIC.exe Token: SeSystemProfilePrivilege 428 WMIC.exe Token: SeSystemtimePrivilege 428 WMIC.exe Token: SeProfSingleProcessPrivilege 428 WMIC.exe Token: SeIncBasePriorityPrivilege 428 WMIC.exe Token: SeCreatePagefilePrivilege 428 WMIC.exe Token: SeBackupPrivilege 428 WMIC.exe Token: SeRestorePrivilege 428 WMIC.exe Token: SeShutdownPrivilege 428 WMIC.exe Token: SeDebugPrivilege 428 WMIC.exe Token: SeSystemEnvironmentPrivilege 428 WMIC.exe Token: SeRemoteShutdownPrivilege 428 WMIC.exe Token: SeUndockPrivilege 428 WMIC.exe Token: SeManageVolumePrivilege 428 WMIC.exe Token: 33 428 WMIC.exe Token: 34 428 WMIC.exe Token: 35 428 WMIC.exe Token: SeIncreaseQuotaPrivilege 428 WMIC.exe Token: SeSecurityPrivilege 428 WMIC.exe Token: SeTakeOwnershipPrivilege 428 WMIC.exe Token: SeLoadDriverPrivilege 428 WMIC.exe Token: SeSystemProfilePrivilege 428 WMIC.exe Token: SeSystemtimePrivilege 428 WMIC.exe Token: SeProfSingleProcessPrivilege 428 WMIC.exe Token: SeIncBasePriorityPrivilege 428 WMIC.exe Token: SeCreatePagefilePrivilege 428 WMIC.exe Token: SeBackupPrivilege 428 WMIC.exe Token: SeRestorePrivilege 428 WMIC.exe Token: SeShutdownPrivilege 428 WMIC.exe Token: SeDebugPrivilege 428 WMIC.exe Token: SeSystemEnvironmentPrivilege 428 WMIC.exe Token: SeRemoteShutdownPrivilege 428 WMIC.exe Token: SeUndockPrivilege 428 WMIC.exe Token: SeManageVolumePrivilege 428 WMIC.exe Token: 33 428 WMIC.exe Token: 34 428 WMIC.exe Token: 35 428 WMIC.exe Token: SeBackupPrivilege 2924 wbengine.exe Token: SeRestorePrivilege 2924 wbengine.exe Token: SeSecurityPrivilege 2924 wbengine.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2720 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 30 PID 2252 wrote to memory of 2720 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 30 PID 2252 wrote to memory of 2720 2252 2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe 30 PID 2720 wrote to memory of 2000 2720 svchost.exe 31 PID 2720 wrote to memory of 2000 2720 svchost.exe 31 PID 2720 wrote to memory of 2000 2720 svchost.exe 31 PID 2000 wrote to memory of 744 2000 cmd.exe 33 PID 2000 wrote to memory of 744 2000 cmd.exe 33 PID 2000 wrote to memory of 744 2000 cmd.exe 33 PID 2000 wrote to memory of 428 2000 cmd.exe 36 PID 2000 wrote to memory of 428 2000 cmd.exe 36 PID 2000 wrote to memory of 428 2000 cmd.exe 36 PID 2720 wrote to memory of 936 2720 svchost.exe 38 PID 2720 wrote to memory of 936 2720 svchost.exe 38 PID 2720 wrote to memory of 936 2720 svchost.exe 38 PID 936 wrote to memory of 1512 936 cmd.exe 40 PID 936 wrote to memory of 1512 936 cmd.exe 40 PID 936 wrote to memory of 1512 936 cmd.exe 40 PID 936 wrote to memory of 2276 936 cmd.exe 41 PID 936 wrote to memory of 2276 936 cmd.exe 41 PID 936 wrote to memory of 2276 936 cmd.exe 41 PID 2720 wrote to memory of 2392 2720 svchost.exe 42 PID 2720 wrote to memory of 2392 2720 svchost.exe 42 PID 2720 wrote to memory of 2392 2720 svchost.exe 42 PID 2392 wrote to memory of 2972 2392 cmd.exe 44 PID 2392 wrote to memory of 2972 2392 cmd.exe 44 PID 2392 wrote to memory of 2972 2392 cmd.exe 44 PID 2720 wrote to memory of 2536 2720 svchost.exe 49 PID 2720 wrote to memory of 2536 2720 svchost.exe 49 PID 2720 wrote to memory of 2536 2720 svchost.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-10_f4546cd292db332bd3450843677a210a_chaos_destroyer_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:744
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1512
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2972
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2536
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2984
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58db9e08eac765c8f278e035e470894bc
SHA177b2fe84d288c0e4ec6d9f3d9788b794fdbc57ce
SHA256c86fa1f056ba18c247b0ea1c2cb1211f3529b884926f32f744a23b6550dd2516
SHA5127f14459597b305d17396d8a5d569ca355c7f2bc194852637670a9f29e500dfb86b434b654545e85e4381b1eafa060b3f82f47b1d09bd160b0930b30e6d232d03
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
32KB
MD5f4546cd292db332bd3450843677a210a
SHA1e933a17670e7ccf12bd74940f1b28e484be890a3
SHA256a34420684f2cac84d72ed9ce886e22327e8d316cb13b177076b6eac639149499
SHA512217703a0b55c7e2923bb5b659c489141ec8d96ae97eaa423d9881eb4fdbd31b5913c5ee3813e513f60ec0da37c826295517acca293edab153cff11df47a2c604