Overview

overview

10

Static

static

10

2024-01-30...ry.exe

windows7-x64

10

2024-01-30...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2024, 03:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-01-30_0f83609227da47f2f02b75c755c2fe0d_wannacry.exe
  • Size 443KB
  • Sample240130-dxx7eahadk
  • SHA256 f8cc80f094616313745e1e22b6a2399081a02974e8231c20c0bffdf610c1b969
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 3 IoCs
  • Detects command variations typically used by ransomware 3 IoCs
  • Renames multiple (92) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-30_0f83609227da47f2f02b75c755c2fe0d_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-30_0f83609227da47f2f02b75c755c2fe0d_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\UNLOCK_MY_FILES.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:4924

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\svchost.exe
        • Size 443KB
        • SHA256 f8cc80f094616313745e1e22b6a2399081a02974e8231c20c0bffdf610c1b969
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\svchost.exe
        • Size 357KB
        • SHA256 8255e896415fd25b4d0169382783fe45368cd0e92e28a48f8444b2bbb753514f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UNLOCK_MY_FILES.txt
        • Path C:\Users\Admin\Music\UNLOCK_MY_FILES.txt
        • Size 1KB
        • SHA256 8228e72405546507838669b204078d623998293d9aa7e20504de1e6cd1314640
        • MD5 SHA1 SHA512
        Submit Download

        memory/2208-0-0x0000000000200000-0x0000000000274000-memory.dmp
        Download

        memory/2208-1-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp
        Download

        memory/2208-14-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp
        Download

        memory/2484-15-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp
        Download

        memory/2484-218-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp
        Download