Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-08-2024 06:52
General
-
Target
2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe
-
Size
477KB
-
MD5
518177458b8b14e366b8f0cd7877d167
-
SHA1
2257cac50a7e658cb334c01458d8f039ce837ca0
-
SHA256
69f8a9fe833a4e2da62d8112f07001d26286a3aca3a59c7a2174581eb99db735
-
SHA512
5981dce9a119ee96ecb77894cc4509766f1e486d1c02f688fccd07eed0d67b2e96bc82f1adadf9087555ae431dcc0ab5e8b492d5dc8caf962086d9ec2114d03b
-
SSDEEP
12288:SL4mKpjv4kjqy+Xr1x/chx5n+rhqbrB8cEfN7Kwp:S467Dm6cE
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Beni Oku !!!2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Beni Oku !!!"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c44d2804d59f4cb9321dab255b33d64d
SHA13c8683f5165de385fac8b6b8df84ff1c0381d306
SHA2565684bc900c708d48bfa613ab30495c8b4e9c13d3d8d3a685e39226173f39d7a9
SHA512da548d586df2c86f132eff390d485ad344f279882879f84bc5e5f7005e06dec811db466cd5e21de08d8c09888ea7a54856ee5429c060b253826531acbdd5e658
-
Filesize
663B
MD55a9d6e59ec170586af58cfd1f0470d1e
SHA10e4e4aa570b0b3fc5a7c6cc6194b213f6cf3981a
SHA256b1e5a9494f7a679814360b3a2155335567d56049648437f79dbcf11ec8cee0f7
SHA512fe61e31602fa68de96cb7c0e9dc22704263862cd5743ddaf8e740d278a764f2453b11cb27cb60ae9ff72d993e1d3cf8991a898fd9ab854d08f7b78ed595910bb
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB