Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 15:35

General

  • Target

    2024-04-06_4c5cb08f2367e302ecb42531c36776a0_wannacry.exe

  • Size

    280KB

  • MD5

    4c5cb08f2367e302ecb42531c36776a0

  • SHA1

    4f1d06dd3cb123214aa25aba3fd3d142cdc1e8dc

  • SHA256

    2dec9e4e6c2b23869ee65cacc7f0011dc3592c5c2ba2da8358063741671a4ad6

  • SHA512

    a79f4808e48872b65262aa3a57f1239eb0698c86f3f48f619d6cb6349d85c6e4007228e67eccc4e4158c83cc4fa4498066d26bf95fa9934c8ad2224ac10c0be4

  • SSDEEP

    6144:qr9L8jq2Gteiy0KhK6bClLmlJNZtHim/WnA/77FfA4RL4xLZTogzI:jPGteiy0cKeeLmlJNZtCmGM7FfxLctTr

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 2 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Detects command variations typically used by ransomware 2 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-06_4c5cb08f2367e302ecb42531c36776a0_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-06_4c5cb08f2367e302ecb42531c36776a0_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:5028
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4896
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3412
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1056
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4284
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2536
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4544
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4336
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:1656
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      280KB

      MD5

      4c5cb08f2367e302ecb42531c36776a0

      SHA1

      4f1d06dd3cb123214aa25aba3fd3d142cdc1e8dc

      SHA256

      2dec9e4e6c2b23869ee65cacc7f0011dc3592c5c2ba2da8358063741671a4ad6

      SHA512

      a79f4808e48872b65262aa3a57f1239eb0698c86f3f48f619d6cb6349d85c6e4007228e67eccc4e4158c83cc4fa4498066d26bf95fa9934c8ad2224ac10c0be4

    • C:\Users\Admin\Documents\read_it.txt

      Filesize

      984B

      MD5

      a9025b6c8b3bd35e386bb0f8b97c6f2f

      SHA1

      322cfbb0af7316d54ba22d2db71ad7e9cede073e

      SHA256

      c88315ca4262a30f70a14fc49729c31e78c5cd40c6a34660964b0c121d064954

      SHA512

      48072e27249be0b3ec835de962c2b1a842748d1541c06a439a1f3fe61afed4e45051c641bb2e4975b71664e79be61e9982dcb0d6e2000b3ab413c445e5850d40

    • memory/116-15-0x00007FF9804F0000-0x00007FF980FB1000-memory.dmp

      Filesize

      10.8MB

    • memory/116-426-0x00007FF9804F0000-0x00007FF980FB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4068-0-0x0000000000380000-0x00000000003CC000-memory.dmp

      Filesize

      304KB

    • memory/4068-1-0x00007FF9804F0000-0x00007FF980FB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4068-14-0x00007FF9804F0000-0x00007FF980FB1000-memory.dmp

      Filesize

      10.8MB