Analysis
-
max time kernel
101s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2025, 21:43
Behavioral task
behavioral1
Sample
2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe
-
Size
28KB
-
MD5
5cbae06a1b1876d43eddfde3dd8409eb
-
SHA1
67d71c6a4811cc8ab6c1ff60f764ab6ca655e8a8
-
SHA256
39233ea5a96b17c0f8cfc3341705120fbbac7d274d9d408b660d2c61ba5b7771
-
SHA512
ec16edc0824c5aece50a88aa726e026cb1b7b9642694ed46fb985552e59296984a6415816577a6ad9adcc66dcdd6896b7adf42f9dfcbdded49828d61c0799485
-
SSDEEP
384:iYenjLLAvS6FidaaKcgwof52OVp912TXZxDGKr:BKRoaKcgwVc9MTpxDZ
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/684-1-0x0000000000B60000-0x0000000000B6C000-memory.dmp family_chaos behavioral2/files/0x000700000002421e-7.dat family_chaos -
Chaos family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation test.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.url test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini test.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt test.exe -
Executes dropped EXE 1 IoCs
pid Process 4552 test.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini test.exe File opened for modification C:\Users\Admin\Music\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini test.exe File opened for modification C:\Users\Public\Music\desktop.ini test.exe File opened for modification C:\Users\Public\Pictures\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini test.exe File opened for modification C:\Users\Admin\Links\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini test.exe File opened for modification C:\Users\Public\Desktop\desktop.ini test.exe File opened for modification C:\Users\Public\Downloads\desktop.ini test.exe File opened for modification C:\Users\Public\Libraries\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini test.exe File opened for modification C:\Users\Admin\Documents\desktop.ini test.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini test.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini test.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini test.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini test.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini test.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini test.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini test.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini test.exe File opened for modification C:\Users\Admin\Videos\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini test.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini test.exe File opened for modification C:\Users\Admin\Searches\desktop.ini test.exe File opened for modification C:\Users\Public\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini test.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini test.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini test.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini test.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini test.exe File opened for modification C:\Users\Public\Videos\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini test.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini test.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini test.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings test.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3212 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4552 test.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe 4552 test.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe Token: SeDebugPrivilege 4552 test.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 684 wrote to memory of 4552 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 97 PID 684 wrote to memory of 4552 684 2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe 97 PID 4552 wrote to memory of 3212 4552 test.exe 100 PID 4552 wrote to memory of 3212 4552 test.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Roaming\test.exe"C:\Users\Admin\AppData\Roaming\test.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:3212
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2025-03-29_5cbae06a1b1876d43eddfde3dd8409eb_destroyer_wannacry.exe.log
Filesize226B
MD528d7fcc2b910da5e67ebb99451a5f598
SHA1a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA2562391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
SHA5122d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
-
Filesize
28KB
MD55cbae06a1b1876d43eddfde3dd8409eb
SHA167d71c6a4811cc8ab6c1ff60f764ab6ca655e8a8
SHA25639233ea5a96b17c0f8cfc3341705120fbbac7d274d9d408b660d2c61ba5b7771
SHA512ec16edc0824c5aece50a88aa726e026cb1b7b9642694ed46fb985552e59296984a6415816577a6ad9adcc66dcdd6896b7adf42f9dfcbdded49828d61c0799485
-
Filesize
24B
MD59d1ff797240f6de24a8f33c36c9d8d16
SHA16112ce9ca7cf9573198daa820752e32a1d06359b
SHA25658d64155da22110c78c12d6fcb6257b99a07f519319a9f096081370eba40bdfa
SHA512bbc456156ea018b36c7f884ca089d932560b2d457cd936f90135718f476585894daf0c58dfa55d5e9f5c8fd2743cebf4569df8319d8e8d980ebcff50817de71e