Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 16:28
Behavioral task
behavioral1
Sample
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe
-
Size
21KB
-
MD5
a1a903c5a6cb70282502e31c0a5baab7
-
SHA1
0a452c52690ed627a3f072d372454b3e8f6ce73a
-
SHA256
9d898d6795f3d5cab2fbdb217d24d7504d7da4e67c7ed41e9c1468e49f96de00
-
SHA512
f8b48b0a04f8bbf6f9a63999ad1ded375ace71bb432c18f421c5832ccf65984bab876af4220212a40e45596c9f3fdcc0c5ef8a0facf4a401a54617c7cda53559
-
SSDEEP
384:u3MLWHn3kIM6s33BK9vp1V+tQoN7J/r91CrbCM7ex:Sn3kIU3xOvpOQq/r9Sbzex
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2724-1-0x0000000000820000-0x000000000082C000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos behavioral1/memory/2720-8-0x0000000001130000-0x000000000113C000-memory.dmp family_chaos -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2720 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2152 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2720 svchost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exesvchost.exepid process 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exesvchost.exedescription pid process Token: SeDebugPrivilege 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe Token: SeDebugPrivilege 2720 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exesvchost.exedescription pid process target process PID 2724 wrote to memory of 2720 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe svchost.exe PID 2724 wrote to memory of 2720 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe svchost.exe PID 2724 wrote to memory of 2720 2724 20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe svchost.exe PID 2720 wrote to memory of 2152 2720 svchost.exe NOTEPAD.EXE PID 2720 wrote to memory of 2152 2720 svchost.exe NOTEPAD.EXE PID 2720 wrote to memory of 2152 2720 svchost.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe"C:\Users\Admin\AppData\Local\Temp\20240926a1a903c5a6cb70282502e31c0a5baab7destroyerwannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5a1a903c5a6cb70282502e31c0a5baab7
SHA10a452c52690ed627a3f072d372454b3e8f6ce73a
SHA2569d898d6795f3d5cab2fbdb217d24d7504d7da4e67c7ed41e9c1468e49f96de00
SHA512f8b48b0a04f8bbf6f9a63999ad1ded375ace71bb432c18f421c5832ccf65984bab876af4220212a40e45596c9f3fdcc0c5ef8a0facf4a401a54617c7cda53559
-
Filesize
498B
MD5f3467a18bc9bff5d1fa6fde886434b25
SHA1a99e70caecf250cbb3b99407225305dd13a5c397
SHA256214e91de820244192eba3647e738b19807fd67cdb7c63cabbcdc17c8de03e783
SHA512cdd9b1f4037e8e2f111b0331666dfdcf33a7a86c075b548148608e2c6410eda510afe4817b3375b0d6acb0e923c9e54b359226d538f8b74db921eac70b8fe840