Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 03:33
Behavioral task
behavioral1
Sample
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe
-
Size
23KB
-
MD5
2a163665e2c9b007dddaa37bd4f5eb11
-
SHA1
23e2bc9ff87681a093465389ab3b4e7dba6df7b5
-
SHA256
fb883f97d3c70a079865c0e7e1f5c97da399b06eaaad65eaa19c7ec90ec5c09f
-
SHA512
1612a909c5a7544e78270b800022f76e9325a713f77a676c51e5647c976dab3219d3bd1322fb18974479aa5294a0dd50f85644a781f92a06a0b6e09c6a5554c3
-
SSDEEP
384:73MLWHn3kI3PSCV3pO/sBNakUJxr91CzxbUOeq:nn3kIVpL8xr9ixbBeq
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
chaos
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-1-0x00000000000C0000-0x00000000000CC000-memory.dmp family_chaos behavioral1/memory/2744-7-0x00000000012D0000-0x00000000012DC000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\zambaramba.exe family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 780 bcdedit.exe 320 bcdedit.exe -
Processes:
wbadmin.exepid process 2512 wbadmin.exe -
Drops startup file 3 IoCs
Processes:
zambaramba.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zambaramba.url zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini zambaramba.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt zambaramba.exe -
Executes dropped EXE 1 IoCs
Processes:
zambaramba.exepid process 2744 zambaramba.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
zambaramba.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Documents\desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini zambaramba.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Music\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Music\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Links\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Searches\desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Desktop\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Videos\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Documents\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini zambaramba.exe File opened for modification C:\Users\Public\Pictures\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini zambaramba.exe File opened for modification C:\Users\Admin\Videos\desktop.ini zambaramba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2948 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2360 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
zambaramba.exepid process 2744 zambaramba.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exezambaramba.exepid process 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe 2744 zambaramba.exe 2744 zambaramba.exe 2744 zambaramba.exe 2744 zambaramba.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exezambaramba.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe Token: SeDebugPrivilege 2744 zambaramba.exe Token: SeBackupPrivilege 2452 vssvc.exe Token: SeRestorePrivilege 2452 vssvc.exe Token: SeAuditPrivilege 2452 vssvc.exe Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe Token: SeSecurityPrivilege 2016 WMIC.exe Token: SeTakeOwnershipPrivilege 2016 WMIC.exe Token: SeLoadDriverPrivilege 2016 WMIC.exe Token: SeSystemProfilePrivilege 2016 WMIC.exe Token: SeSystemtimePrivilege 2016 WMIC.exe Token: SeProfSingleProcessPrivilege 2016 WMIC.exe Token: SeIncBasePriorityPrivilege 2016 WMIC.exe Token: SeCreatePagefilePrivilege 2016 WMIC.exe Token: SeBackupPrivilege 2016 WMIC.exe Token: SeRestorePrivilege 2016 WMIC.exe Token: SeShutdownPrivilege 2016 WMIC.exe Token: SeDebugPrivilege 2016 WMIC.exe Token: SeSystemEnvironmentPrivilege 2016 WMIC.exe Token: SeRemoteShutdownPrivilege 2016 WMIC.exe Token: SeUndockPrivilege 2016 WMIC.exe Token: SeManageVolumePrivilege 2016 WMIC.exe Token: 33 2016 WMIC.exe Token: 34 2016 WMIC.exe Token: 35 2016 WMIC.exe Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe Token: SeSecurityPrivilege 2016 WMIC.exe Token: SeTakeOwnershipPrivilege 2016 WMIC.exe Token: SeLoadDriverPrivilege 2016 WMIC.exe Token: SeSystemProfilePrivilege 2016 WMIC.exe Token: SeSystemtimePrivilege 2016 WMIC.exe Token: SeProfSingleProcessPrivilege 2016 WMIC.exe Token: SeIncBasePriorityPrivilege 2016 WMIC.exe Token: SeCreatePagefilePrivilege 2016 WMIC.exe Token: SeBackupPrivilege 2016 WMIC.exe Token: SeRestorePrivilege 2016 WMIC.exe Token: SeShutdownPrivilege 2016 WMIC.exe Token: SeDebugPrivilege 2016 WMIC.exe Token: SeSystemEnvironmentPrivilege 2016 WMIC.exe Token: SeRemoteShutdownPrivilege 2016 WMIC.exe Token: SeUndockPrivilege 2016 WMIC.exe Token: SeManageVolumePrivilege 2016 WMIC.exe Token: 33 2016 WMIC.exe Token: 34 2016 WMIC.exe Token: 35 2016 WMIC.exe Token: SeBackupPrivilege 576 wbengine.exe Token: SeRestorePrivilege 576 wbengine.exe Token: SeSecurityPrivilege 576 wbengine.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exezambaramba.execmd.execmd.execmd.exedescription pid process target process PID 2932 wrote to memory of 2744 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe zambaramba.exe PID 2932 wrote to memory of 2744 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe zambaramba.exe PID 2932 wrote to memory of 2744 2932 2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe zambaramba.exe PID 2744 wrote to memory of 2556 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 2556 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 2556 2744 zambaramba.exe cmd.exe PID 2556 wrote to memory of 2948 2556 cmd.exe vssadmin.exe PID 2556 wrote to memory of 2948 2556 cmd.exe vssadmin.exe PID 2556 wrote to memory of 2948 2556 cmd.exe vssadmin.exe PID 2556 wrote to memory of 2016 2556 cmd.exe WMIC.exe PID 2556 wrote to memory of 2016 2556 cmd.exe WMIC.exe PID 2556 wrote to memory of 2016 2556 cmd.exe WMIC.exe PID 2744 wrote to memory of 772 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 772 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 772 2744 zambaramba.exe cmd.exe PID 772 wrote to memory of 780 772 cmd.exe bcdedit.exe PID 772 wrote to memory of 780 772 cmd.exe bcdedit.exe PID 772 wrote to memory of 780 772 cmd.exe bcdedit.exe PID 772 wrote to memory of 320 772 cmd.exe bcdedit.exe PID 772 wrote to memory of 320 772 cmd.exe bcdedit.exe PID 772 wrote to memory of 320 772 cmd.exe bcdedit.exe PID 2744 wrote to memory of 3052 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 3052 2744 zambaramba.exe cmd.exe PID 2744 wrote to memory of 3052 2744 zambaramba.exe cmd.exe PID 3052 wrote to memory of 2512 3052 cmd.exe wbadmin.exe PID 3052 wrote to memory of 2512 3052 cmd.exe wbadmin.exe PID 3052 wrote to memory of 2512 3052 cmd.exe wbadmin.exe PID 2744 wrote to memory of 2360 2744 zambaramba.exe NOTEPAD.EXE PID 2744 wrote to memory of 2360 2744 zambaramba.exe NOTEPAD.EXE PID 2744 wrote to memory of 2360 2744 zambaramba.exe NOTEPAD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_2a163665e2c9b007dddaa37bd4f5eb11_chaos_destroyer_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Roaming\zambaramba.exe"C:\Users\Admin\AppData\Roaming\zambaramba.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2948 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:780 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2512 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2360
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1828
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD52a163665e2c9b007dddaa37bd4f5eb11
SHA123e2bc9ff87681a093465389ab3b4e7dba6df7b5
SHA256fb883f97d3c70a079865c0e7e1f5c97da399b06eaaad65eaa19c7ec90ec5c09f
SHA5121612a909c5a7544e78270b800022f76e9325a713f77a676c51e5647c976dab3219d3bd1322fb18974479aa5294a0dd50f85644a781f92a06a0b6e09c6a5554c3
-
Filesize
971B
MD56d081874126362534d35057a296d2287
SHA131208b98e212c86423e9f42b911a10073b695c38
SHA256d7f27743b24a4e099216d76828ceb277d9e2e6dd2e2a958de22b3e277a01e482
SHA5120b6abda02243dd63a69cba826396432fd6e9d916a06ebb9038133fa18ea112cb7caafe0188f4cb1aef2232f136b68cdbdd6fb2c726955c10ae3b3ba995d3a932