Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 04:46
Behavioral task
behavioral1
Sample
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe
-
Size
223KB
-
MD5
a32b23db12286223af4786eccf8f66d7
-
SHA1
fe19f59183dcf801749457140b4b3aeeb3e82598
-
SHA256
5f161fe20eafa6de2ad791276d14bd1c28013a1dd7b83b8b20016ea3065eacbf
-
SHA512
0395949d424e0898d25efa5713952c2e2df155f743c5d158003268256c4c541bd83c10bf2653e4fa31ed52bb1a044e4e19e9464f7d972313a5a8e2f1b4856aa0
-
SSDEEP
6144:m4Er9iAYFCtntIVprUPvEefILCrSK3FK+x:m4GYFCtntIVqPvCLCrSK1K+x
Malware Config
Extracted
C:\Users\Admin\Desktop\read_it.txt
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-0-0x0000000000DA0000-0x0000000000DDE000-memory.dmp family_chaos C:\Users\Admin\AppData\Roaming\svchost.exe family_chaos behavioral1/memory/1844-7-0x0000000000F80000-0x0000000000FBE000-memory.dmp family_chaos -
Detects command variations typically used by ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-0-0x0000000000DA0000-0x0000000000DDE000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware C:\Users\Admin\AppData\Roaming\svchost.exe INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/1844-7-0x0000000000F80000-0x0000000000FBE000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1844 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\knc4pufin.jpg" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2560 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 1844 svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exesvchost.exepid process 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe 1844 svchost.exe 1844 svchost.exe 1844 svchost.exe 1844 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exesvchost.exedescription pid process Token: SeDebugPrivilege 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe Token: SeDebugPrivilege 1844 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exesvchost.exedescription pid process target process PID 2264 wrote to memory of 1844 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe svchost.exe PID 2264 wrote to memory of 1844 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe svchost.exe PID 2264 wrote to memory of 1844 2264 2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe svchost.exe PID 1844 wrote to memory of 2560 1844 svchost.exe NOTEPAD.EXE PID 1844 wrote to memory of 2560 1844 svchost.exe NOTEPAD.EXE PID 1844 wrote to memory of 2560 1844 svchost.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_a32b23db12286223af4786eccf8f66d7_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5a32b23db12286223af4786eccf8f66d7
SHA1fe19f59183dcf801749457140b4b3aeeb3e82598
SHA2565f161fe20eafa6de2ad791276d14bd1c28013a1dd7b83b8b20016ea3065eacbf
SHA5120395949d424e0898d25efa5713952c2e2df155f743c5d158003268256c4c541bd83c10bf2653e4fa31ed52bb1a044e4e19e9464f7d972313a5a8e2f1b4856aa0
-
Filesize
1KB
MD5ea03cbb2fdf2dc96252b579612602225
SHA1ac9ceff3c368f7409b9a7201f62fa92eded4da51
SHA256e4f0c335d1ffc3ed4a32ae4aee294c9652f67a765fbaaad1f90e0540d25ed565
SHA5121388a3f740f84541f8a8c0298bfe8b71f03d86a71174f97a68edcb4bdca0f467d6823b94314fa54547451c3ec4f6bc2228d74bf7537acf7c2dfb9f5a2d398051