Analysis
-
max time kernel
90s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 04:17
Behavioral task
behavioral1
Sample
2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe
Resource
win7-20240708-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe
-
Size
238KB
-
MD5
86faf18098e56c8c610b960d684a21d8
-
SHA1
db0eb3968c11da86490b679e7daded59b6006310
-
SHA256
4e758d011d1d615ebd05c6ffe441dedf5d371efb1dca1c624ec896f56de19979
-
SHA512
8c87c1847edeb56fc46d0e1adcf3bb8cc024d63fa9d2d49dd7bda68efb1c5fe473f001250408accccb86915cc5f077a46a28189b073cdd557d9042e48c7f4a9b
-
SSDEEP
3072:K6Mq98ySh8of8yx/se2nz2j0XdNkgVjdLyWNgXc0IohbnivKUbUtHO9sO3LccckL:K6Mq9e2q+nRfkg7Scy4KUQHO9h3LN
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 3 IoCs
resource yara_rule behavioral1/memory/1724-1-0x0000000000A50000-0x0000000000A92000-memory.dmp family_chaos behavioral1/files/0x000a000000012291-6.dat family_chaos behavioral1/memory/1856-8-0x0000000000C60000-0x0000000000CA2000-memory.dmp family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2364 bcdedit.exe 672 bcdedit.exe -
Renames multiple (194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1048 wbadmin.exe -
Disables Task Manager via registry modification
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Womp-Womp.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1856 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L2BFB2JG\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\63WZ73PY\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Public\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROVWYKHE\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7CO3PKGI\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9C9T5AL\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YQ90JXIE\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rz7kdatc5.jpg" svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2888 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1856 svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe Token: SeDebugPrivilege 1856 svchost.exe Token: SeBackupPrivilege 2932 vssvc.exe Token: SeRestorePrivilege 2932 vssvc.exe Token: SeAuditPrivilege 2932 vssvc.exe Token: SeIncreaseQuotaPrivilege 1732 WMIC.exe Token: SeSecurityPrivilege 1732 WMIC.exe Token: SeTakeOwnershipPrivilege 1732 WMIC.exe Token: SeLoadDriverPrivilege 1732 WMIC.exe Token: SeSystemProfilePrivilege 1732 WMIC.exe Token: SeSystemtimePrivilege 1732 WMIC.exe Token: SeProfSingleProcessPrivilege 1732 WMIC.exe Token: SeIncBasePriorityPrivilege 1732 WMIC.exe Token: SeCreatePagefilePrivilege 1732 WMIC.exe Token: SeBackupPrivilege 1732 WMIC.exe Token: SeRestorePrivilege 1732 WMIC.exe Token: SeShutdownPrivilege 1732 WMIC.exe Token: SeDebugPrivilege 1732 WMIC.exe Token: SeSystemEnvironmentPrivilege 1732 WMIC.exe Token: SeRemoteShutdownPrivilege 1732 WMIC.exe Token: SeUndockPrivilege 1732 WMIC.exe Token: SeManageVolumePrivilege 1732 WMIC.exe Token: 33 1732 WMIC.exe Token: 34 1732 WMIC.exe Token: 35 1732 WMIC.exe Token: SeIncreaseQuotaPrivilege 1732 WMIC.exe Token: SeSecurityPrivilege 1732 WMIC.exe Token: SeTakeOwnershipPrivilege 1732 WMIC.exe Token: SeLoadDriverPrivilege 1732 WMIC.exe Token: SeSystemProfilePrivilege 1732 WMIC.exe Token: SeSystemtimePrivilege 1732 WMIC.exe Token: SeProfSingleProcessPrivilege 1732 WMIC.exe Token: SeIncBasePriorityPrivilege 1732 WMIC.exe Token: SeCreatePagefilePrivilege 1732 WMIC.exe Token: SeBackupPrivilege 1732 WMIC.exe Token: SeRestorePrivilege 1732 WMIC.exe Token: SeShutdownPrivilege 1732 WMIC.exe Token: SeDebugPrivilege 1732 WMIC.exe Token: SeSystemEnvironmentPrivilege 1732 WMIC.exe Token: SeRemoteShutdownPrivilege 1732 WMIC.exe Token: SeUndockPrivilege 1732 WMIC.exe Token: SeManageVolumePrivilege 1732 WMIC.exe Token: 33 1732 WMIC.exe Token: 34 1732 WMIC.exe Token: 35 1732 WMIC.exe Token: SeBackupPrivilege 1912 wbengine.exe Token: SeRestorePrivilege 1912 wbengine.exe Token: SeSecurityPrivilege 1912 wbengine.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 NOTEPAD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1056 mspaint.exe 1056 mspaint.exe 1056 mspaint.exe 1056 mspaint.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1856 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 30 PID 1724 wrote to memory of 1856 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 30 PID 1724 wrote to memory of 1856 1724 2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe 30 PID 1856 wrote to memory of 2896 1856 svchost.exe 31 PID 1856 wrote to memory of 2896 1856 svchost.exe 31 PID 1856 wrote to memory of 2896 1856 svchost.exe 31 PID 2896 wrote to memory of 2888 2896 cmd.exe 33 PID 2896 wrote to memory of 2888 2896 cmd.exe 33 PID 2896 wrote to memory of 2888 2896 cmd.exe 33 PID 2896 wrote to memory of 1732 2896 cmd.exe 36 PID 2896 wrote to memory of 1732 2896 cmd.exe 36 PID 2896 wrote to memory of 1732 2896 cmd.exe 36 PID 1856 wrote to memory of 1880 1856 svchost.exe 38 PID 1856 wrote to memory of 1880 1856 svchost.exe 38 PID 1856 wrote to memory of 1880 1856 svchost.exe 38 PID 1880 wrote to memory of 2364 1880 cmd.exe 40 PID 1880 wrote to memory of 2364 1880 cmd.exe 40 PID 1880 wrote to memory of 2364 1880 cmd.exe 40 PID 1880 wrote to memory of 672 1880 cmd.exe 41 PID 1880 wrote to memory of 672 1880 cmd.exe 41 PID 1880 wrote to memory of 672 1880 cmd.exe 41 PID 1856 wrote to memory of 564 1856 svchost.exe 42 PID 1856 wrote to memory of 564 1856 svchost.exe 42 PID 1856 wrote to memory of 564 1856 svchost.exe 42 PID 564 wrote to memory of 1048 564 cmd.exe 44 PID 564 wrote to memory of 1048 564 cmd.exe 44 PID 564 wrote to memory of 1048 564 cmd.exe 44 PID 1856 wrote to memory of 1940 1856 svchost.exe 49 PID 1856 wrote to memory of 1940 1856 svchost.exe 49 PID 1856 wrote to memory of 1940 1856 svchost.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_86faf18098e56c8c610b960d684a21d8_wannacry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2888
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2364
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1048
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Womp-Womp.txt3⤵
- Suspicious use of FindShellTrayWindow
PID:1940
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1704
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1720
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\InitializeRegister.emf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1056
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Pictures\GetUninstall.bmp.dontblockpeople1⤵
- Modifies registry class
PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD586faf18098e56c8c610b960d684a21d8
SHA1db0eb3968c11da86490b679e7daded59b6006310
SHA2564e758d011d1d615ebd05c6ffe441dedf5d371efb1dca1c624ec896f56de19979
SHA5128c87c1847edeb56fc46d0e1adcf3bb8cc024d63fa9d2d49dd7bda68efb1c5fe473f001250408accccb86915cc5f077a46a28189b073cdd557d9042e48c7f4a9b
-
Filesize
17B
MD51aae33bf814be3680af0c9e9d3f6bf06
SHA117cb8561c9d25c03eebd8691cd19f90b50916662
SHA2566cab9d341be7e586c79eb547831906554eb6c12662a680e0992ed181a0ba691c
SHA512a28b1ac387afa4c6c5c76c3e510e7de58d426b12dd06d5efe3348214842a7da5621cf8a1bac93f609b140ed4c4c524784886f027c254c65525478219f699661d
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0