Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
03/04/2024, 22:28 UTC
General
-
Target
2024-04-03_35cd5196973ea268366e117948e3234e_wannacry.exe
-
Size
138KB
-
MD5
35cd5196973ea268366e117948e3234e
-
SHA1
d3b0408dd73972b1228dbc6eedae887020069205
-
SHA256
d487a3562cfb46a5992deac8a154f6b84b4b046fb98252e51b9c75310a8e4610
-
SHA512
250080b16b12a3b36ea27a621ca1a9664aff0cbbd4e7c286ed030edad2a568d338c1f40817e9643b896ef23e5992372ee6866a972fdccac14005d02a1bff9f8e
-
SSDEEP
3072:Too9Lr9+OjsHL8Czl4rPT5E6JHztz3M1j/20:9r9+Ow8frT66tFYj/2
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 2 IoCs
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_35cd5196973ea268366e117948e3234e_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_35cd5196973ea268366e117948e3234e_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS210.108.222.173.in-addr.arpaRemote address:8.8.8.8:53Request210.108.222.173.in-addr.arpaIN PTRResponse210.108.222.173.in-addr.arpaIN PTRa173-222-108-210deploystaticakamaitechnologiescom -
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS140.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS131.72.42.20.in-addr.arpaRemote address:8.8.8.8:53Request131.72.42.20.in-addr.arpaIN PTRResponse
-
52.111.227.14:443
-
8.8.8.8:53210.108.222.173.in-addr.arpadns
DNS Request
210.108.222.173.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53140.32.126.40.in-addr.arpadns
DNS Request
140.32.126.40.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:53131.72.42.20.in-addr.arpadns
DNS Request
131.72.42.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD535cd5196973ea268366e117948e3234e
SHA1d3b0408dd73972b1228dbc6eedae887020069205
SHA256d487a3562cfb46a5992deac8a154f6b84b4b046fb98252e51b9c75310a8e4610
SHA512250080b16b12a3b36ea27a621ca1a9664aff0cbbd4e7c286ed030edad2a568d338c1f40817e9643b896ef23e5992372ee6866a972fdccac14005d02a1bff9f8e
-
Filesize
555B
MD588e1775159b477cd84de858370a72243
SHA14ba54e4aff5187c036867b2c96c8ab7e75a7955c
SHA256403de26691352cea37b29d2babc62f90c8995dff9a6a367be247ca388a8d1349
SHA51276f9b5001f13488e66fee067140d68eba2082614f41e910d43c1f4b51c793db34b556aab3798714a18ad60e3c958da56d1414d8b74f799f0d72d09a89d03a521
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
160KB
-
Filesize
10.8MB
-
Filesize
10.8MB