Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 20:32

General

  • Target

    2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe

  • Size

    294KB

  • MD5

    5de3be7387ae4c84f1c3931f8f4a4bdb

  • SHA1

    a291b128d79e06bc35a3d7103b6e17aeefe1bfa9

  • SHA256

    a9abad54fc0edbec207aa78275dde697b408f64ec15593982dd1db743c1a82ff

  • SHA512

    57267d315dd75771a7711bf04d8289380e7608f553d03d5e1b0e4918a912c579b50ff01c401aae9fb1de67802ad28e66b82559cf3e0783bff3a9b7ab3f0fc766

  • SSDEEP

    1536:ixDkHJ/b+BgGt+ilZ7K1CM0yt9z6+yMdhvkod5jbuvSf7:FVb+BhMEXUOwdhvNvjbxf7

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted By Salvation X Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $300. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.0043 BTC Bitcoin Address: bc1qfwd8hd2amxc8fc8mrc0m8a83ckyrudnjs6905r Contact Us Telegram- Telegram Group:- https://t.me/DecrypteKey
URLs

https://t.me/DecrypteKey

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Detects command variations typically used by ransomware 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    294KB

    MD5

    5de3be7387ae4c84f1c3931f8f4a4bdb

    SHA1

    a291b128d79e06bc35a3d7103b6e17aeefe1bfa9

    SHA256

    a9abad54fc0edbec207aa78275dde697b408f64ec15593982dd1db743c1a82ff

    SHA512

    57267d315dd75771a7711bf04d8289380e7608f553d03d5e1b0e4918a912c579b50ff01c401aae9fb1de67802ad28e66b82559cf3e0783bff3a9b7ab3f0fc766

  • C:\Users\Admin\Desktop\read_it.txt

    Filesize

    1KB

    MD5

    033c70e11bd9d61f2132307be4740963

    SHA1

    9db63c9f7873de81235c63ffa52477ab3c7e844d

    SHA256

    e2e467b32be5706cc6d660cfa23d5b1e53f66a7d5017265e7f0b3b37596fbacd

    SHA512

    484b47d0a064d5d7a724ac5d4d1a264513da158e881d0c74c43546243fe504a9c830626a1fb085a232943881833f8b61e76ddc5ac4a4c78ee1e109cc0433bc44

  • memory/868-15-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp

    Filesize

    10.8MB

  • memory/868-68-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2468-0-0x0000000000560000-0x00000000005B0000-memory.dmp

    Filesize

    320KB

  • memory/2468-1-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2468-14-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp

    Filesize

    10.8MB