Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 03:29
Behavioral task
behavioral1
Sample
2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe
-
Size
100KB
-
MD5
0fb4787dcc4bcb1f6f78a70e792fbc86
-
SHA1
e89c85f8495282ff03e91acab0ce8ebcba8d3299
-
SHA256
d9773300b2b43d9c2091b02744e472df1fb1e0ab920d0f71eea30647fd2a819b
-
SHA512
d530433119c8ee0117280cbdd9e88d374351ceb887f7e4b0e1481a3c08d27930075f3ca1c87d8b3f43da46adcbcc8a3d8ed3741456a6669b62414a670b58dbd2
-
SSDEEP
3072:ioVUMbr91bmrmNi0XJdsh55gvms+sUnFhKoAvog:nr91Tf5aQv1+YP
Score
10/10
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/2136-0-0x0000000000F10000-0x0000000000F30000-memory.dmp family_chaos behavioral2/files/0x000600000002295f-6.dat family_chaos -
Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/2136-0-0x0000000000F10000-0x0000000000F30000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x000600000002295f-6.dat INDICATOR_SUSPICIOUS_GENRansomware -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 6092 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dgvr7dy8v.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1740 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 6092 svchost.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe 6092 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe Token: SeDebugPrivilege 6092 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 6092 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 87 PID 2136 wrote to memory of 6092 2136 2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe 87 PID 6092 wrote to memory of 1740 6092 svchost.exe 95 PID 6092 wrote to memory of 1740 6092 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_0fb4787dcc4bcb1f6f78a70e792fbc86_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD50fb4787dcc4bcb1f6f78a70e792fbc86
SHA1e89c85f8495282ff03e91acab0ce8ebcba8d3299
SHA256d9773300b2b43d9c2091b02744e472df1fb1e0ab920d0f71eea30647fd2a819b
SHA512d530433119c8ee0117280cbdd9e88d374351ceb887f7e4b0e1481a3c08d27930075f3ca1c87d8b3f43da46adcbcc8a3d8ed3741456a6669b62414a670b58dbd2
-
Filesize
19B
MD591e642f2ab626c3780c0b251eae5f7b8
SHA1f03b96a9cb9ea2646c3bf3a13a3de5e272675c80
SHA25641f25a9ca2b5f87189f0073199c79285d20ca1fb43b48c44f054027ecffa6e90
SHA512a83781fb7168049c04cc6c10497d7c20b668a39752e9b0f2f5120d514189892cf79d9b17979f373351eefa1f6a99d74e9088bae5e54a717eb39aac1c2d539ce5