Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/03/2024, 20:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe
- Size 294KB
- Sample240327-zbry6abe43
- SHA256 a9abad54fc0edbec207aa78275dde697b408f64ec15593982dd1db743c1a82ff
- MD5 5de3be7387ae4c84f1c3931f8f4a4bdb
- SHA1 a291b128d79e06bc35a3d7103b6e17aeefe1bfa9
- SHA512 57267d315dd75771a7711bf04d8289380e7608f553d03d5e1b0e4918a912c579b50ff01c401aae9fb1de67802ad28e66b82559cf3e0783bff3a9b7ab3f0fc766
- SSDEEP 1536:ixDkHJ/b+BgGt+ilZ7K1CM0yt9z6+yMdhvkod5jbuvSf7:FVb+BhMEXUOwdhvNvjbxf7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\read_it.txt
-
chaos
Ransom Note
- ----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted By Salvation X Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $300. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.0043 BTC Bitcoin Address: bc1qfwd8hd2amxc8fc8mrc0m8a83ckyrudnjs6905r Contact Us Telegram- Telegram Group:- https://t.me/DecrypteKey
URLs
-
https://t.me/DecrypteKey
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/2468-0-0x0000000000560000-0x00000000005B0000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x0003000000022898-6.dat INDICATOR_SUSPICIOUS_GENRansomware - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation svchost.exe - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe - Executes dropped EXE 1 IoCs
pid Process 868 svchost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings svchost.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1824 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 868 svchost.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe Token: SeDebugPrivilege 868 svchost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 868 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 87 PID 2468 wrote to memory of 868 2468 2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe 87 PID 868 wrote to memory of 1824 868 svchost.exe 92 PID 868 wrote to memory of 1824 868 svchost.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_5de3be7387ae4c84f1c3931f8f4a4bdb_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1824
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 294KB
- SHA256 a9abad54fc0edbec207aa78275dde697b408f64ec15593982dd1db743c1a82ff
- MD5 5de3be7387ae4c84f1c3931f8f4a4bdb
- SHA1 a291b128d79e06bc35a3d7103b6e17aeefe1bfa9
- SHA512 57267d315dd75771a7711bf04d8289380e7608f553d03d5e1b0e4918a912c579b50ff01c401aae9fb1de67802ad28e66b82559cf3e0783bff3a9b7ab3f0fc766
- SSDEEP 1536:ixDkHJ/b+BgGt+ilZ7K1CM0yt9z6+yMdhvkod5jbuvSf7:FVb+BhMEXUOwdhvNvjbxf7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\read_it.txt
- Size 1KB
- SHA256 e2e467b32be5706cc6d660cfa23d5b1e53f66a7d5017265e7f0b3b37596fbacd
- MD5 033c70e11bd9d61f2132307be4740963
- SHA1 9db63c9f7873de81235c63ffa52477ab3c7e844d
- SHA512 484b47d0a064d5d7a724ac5d4d1a264513da158e881d0c74c43546243fe504a9c830626a1fb085a232943881833f8b61e76ddc5ac4a4c78ee1e109cc0433bc44
- MD5 SHA1 SHA512