Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 23:22
Behavioral task
behavioral1
Sample
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe
-
Size
69KB
-
MD5
8e9498d9f1009d82fe20dec5e56e6ab6
-
SHA1
07fd1c05d1e706a75cb8327bce60524faaf89735
-
SHA256
24893dc83648dac9acf101c38381fbe5f09dff7788e4cd1d9ac6fc10bde8bb7a
-
SHA512
26d1e96bb5bb7cc263c5d5f0688a53c537cac9a11893633b62d38213610d0655e76203c8a6fed6f3c795756039fc24df5b534fe978494e531a6b17e34bfab8d8
-
SSDEEP
1536:fo2yGMhur9i35UbK+X7ryVIxBtNGmD1aBoolWi1UfF:foUMhur9i3MK+X7euBHGmJaBooEF
Malware Config
Extracted
C:\Users\Admin\Documents\read_it.txt
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/664-1-0x0000000000650000-0x0000000000668000-memory.dmp family_chaos -
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Drops startup file 3 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.url 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\j3bjc5lfw.jpg" 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 804 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exepid process 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exepid process 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription pid process Token: SeDebugPrivilege 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exedescription pid process target process PID 664 wrote to memory of 804 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe NOTEPAD.EXE PID 664 wrote to memory of 804 664 2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_8e9498d9f1009d82fe20dec5e56e6ab6_destroyer_wannacry.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt2⤵
- Opens file in notepad (likely ransom note)
PID:804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a12615b25efbc9b0e692d78cf143b46e
SHA13016daff192f705df77c53eea3bbb8bc0d93476c
SHA25619d5acf79db3a71973959348dde1c1f7feb04365addc248e2fbe679131082575
SHA512379226c164f50f5fb8700b934125e926019b43acc1c66d973335b82fe0c7106e1b81e596a32951f06b2908375f062bf5f5f000cf5aaae69cb177668789bd1848