Malware Analysis Report

2025-04-13 21:19

Sample ID 250322-2n7w9asvbz
Target 2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry
SHA256 a00428527fb92182aa0fce541e09b4d7dcb19b00af756f5e15c2dc7c6747bf93
Tags
chaos defense_evasion evasion execution impact ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a00428527fb92182aa0fce541e09b4d7dcb19b00af756f5e15c2dc7c6747bf93

Threat Level: Known bad

The file 2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry was found to be: Known bad.

Malicious Activity Summary

chaos defense_evasion evasion execution impact ransomware spyware stealer

Chaos family

Chaos Ransomware

Chaos

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Drops desktop.ini file(s)

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Checks SCSI registry key(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Opens file in notepad (likely ransom note)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-22 22:44

Signatures

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Chaos family

chaos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-22 22:44

Reported

2025-03-22 22:45

Platform

win11-20250313-en

Max time kernel

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Chaos family

chaos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\stub.url C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt C:\Users\Admin\AppData\Roaming\stub.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1136229799-3442283115-138161576-1000\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\stub.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\stub.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\stub.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe C:\Users\Admin\AppData\Roaming\stub.exe
PID 4224 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe C:\Users\Admin\AppData\Roaming\stub.exe
PID 1768 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 1768 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 1476 wrote to memory of 1900 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1476 wrote to memory of 1900 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1476 wrote to memory of 1728 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1476 wrote to memory of 1728 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 1768 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 2260 wrote to memory of 4560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2260 wrote to memory of 4560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2260 wrote to memory of 2728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2260 wrote to memory of 2728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 924 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 1768 wrote to memory of 924 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\System32\cmd.exe
PID 924 wrote to memory of 2532 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 924 wrote to memory of 2532 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1768 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\system32\NOTEPAD.EXE
PID 1768 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Roaming\stub.exe C:\Windows\system32\NOTEPAD.EXE

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe

"C:\Users\Admin\AppData\Local\Temp\2025-03-22_8b75fae87885a0b1a0c3c2b601d6e399_chaos_destroyer_wannacry.exe"

C:\Users\Admin\AppData\Roaming\stub.exe

"C:\Users\Admin\AppData\Roaming\stub.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\read_it.txt

Network

N/A

Files

memory/4224-0-0x00007FFA6BE93000-0x00007FFA6BE95000-memory.dmp

memory/4224-1-0x0000000000450000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Roaming\stub.exe

MD5 8b75fae87885a0b1a0c3c2b601d6e399
SHA1 120224bd569c681c4cbdf879f341145081bd9317
SHA256 a00428527fb92182aa0fce541e09b4d7dcb19b00af756f5e15c2dc7c6747bf93
SHA512 6719ae41b3918ba58a036e57720303f2b864797b77863834de14451bf8b524c6138e3ab74237258b2a32b8d04498debcda593adbcf418565e714f0506dd5f3c9

memory/1768-14-0x00007FFA6BE90000-0x00007FFA6C952000-memory.dmp

C:\Users\Admin\Desktop\read_it.txt

MD5 76cf4b4b048d3adad48300ddb890b166
SHA1 1099a3ea6d9b92ff9e9fb1fbcaa51b907c65f911
SHA256 55cd6766a0830a3e75eac538e955baa64a2aa5c7ca56661d080919cbe87ea472
SHA512 0ac5807d857cf75ed64bbcd5fcd70d98e08f6a625f774da1402c56228aa492603a578d9461e388f793d3b718d7a19a659e68bb0a043013fb3ce02d71f5b20b4b

memory/1768-74-0x00007FFA6BE90000-0x00007FFA6C952000-memory.dmp

memory/1768-76-0x00007FFA6BE90000-0x00007FFA6C952000-memory.dmp