Overview

overview

10

Static

static

10

2025-03-17...ry.exe

windows7-x64

10

2025-03-17...ry.exe

windows10-2004-x64

10

Resubmissions

25/03/2025, 13:33

250325-qtmbyszqs8 10

25/03/2025, 13:28

250325-qqrr9swyhv 10

17/03/2025, 17:07

250317-vm97navxdt 10

17/03/2025, 16:33

250317-t2ll6svsdv 10

17/03/2025, 16:01

250317-tge9natxcw 10

Analysis

  • max time kernel
    33s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2025, 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-17_fa88e518bfa73401b06f46344fd7f50f_destroyer_wannacry.exe

  • Size

    25KB

  • MD5

    fa88e518bfa73401b06f46344fd7f50f

  • SHA1

    113b0427a8068ee83b5367ba400b8d900ef37d51

  • SHA256

    436a860b7cf33a894940080dba3c9de6b3fc3a619f657915aecc22ea6c1de01f

  • SHA512

    cc1a7cce176861b73dc38463090ad6b487284cd76aac91543be74ae7ac2ff469e05a1555145fb3529b9b33ca2cabb442478df5384ddf4fb036ca89f07694a0d4

  • SSDEEP

    384:jYenjLLAwELM4Nuzb/3m3D4OIp91L5U1mbgyydxDGH:KwELMbXn941Ly+xDI

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\read_it.txt

Ransom Note
Your computer has been permanently locked. You need to contact us to unlock your computer. How to get decryption services, you need to pay a ransom. Contact me by email. [email protected] You only need to pay me $500 and I will unencrypt your computer files for you, otherwise you will never be able to recover your computer data. -------------------------------------------------------------------------------------------------------------------------------------------------------------- 您的计算机已被永久锁定。你需要联系我们解锁你的电脑。 如何获得解密服务，你需要支付赎金。用电子邮件联系我。[email protected] 你只需要付我500美元，我就会为你解密你的电脑文件，否则你将永远无法恢复你的电脑数据。
Emails

[email protected]

如何获得解密服务，你需要支付赎金。用电子邮件联系我。[email protected]

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 1 IoCs
  • Chaos family
    chaos
  • Renames multiple (201) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_fa88e518bfa73401b06f46344fd7f50f_destroyer_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_fa88e518bfa73401b06f46344fd7f50f_destroyer_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\2012_x64_1_vcRuntimeAdditional_x64.log
    Filesize

    1B

    MD5

    d1457b72c3fb323a2671125aef3eab5d

    SHA1

    5bab61eb53176449e25c2c82f172b82cb13ffb9d

    SHA256

    8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

    SHA512

    ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

    Download Submit

  • C:\Users\Admin\read_it.txt
    Filesize

    830B

    MD5

    55be6655caca2486576c70dad6187a71

    SHA1

    1123129f1c851d9adc949704f2517c89d8cd2ea3

    SHA256

    c731f640e6d522d1a455727547aa14fc5e7e4a6a8efbeee1ffcc1b3c48c5a026

    SHA512

    5d15427fbe370dca227b1b4be0ee4b4ad1648daa9cd70fe07d205760a4f7d42a3d50ff3c5d2460b7f8c429387f87fd683ca1f5e4c202c8a047e9ea49f3a217a1

    Download Submit

  • memory/3512-1-0x00000000001B0000-0x00000000001BC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/3512-0-0x00007FF9B00B3000-0x00007FF9B00B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3512-71-0x00007FF9B00B0000-0x00007FF9B0B71000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3512-1398-0x00007FF9B00B3000-0x00007FF9B00B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3512-1399-0x00007FF9B00B0000-0x00007FF9B0B71000-memory.dmp

    Filesize

    10.8MB

    Download