Overview

overview

10

Static

static

10

2024-08-17...ry.exe

windows7-x64

10

2024-08-17...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-08-2024 06:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe

  • Size

    477KB

  • MD5

    518177458b8b14e366b8f0cd7877d167

  • SHA1

    2257cac50a7e658cb334c01458d8f039ce837ca0

  • SHA256

    69f8a9fe833a4e2da62d8112f07001d26286a3aca3a59c7a2174581eb99db735

  • SHA512

    5981dce9a119ee96ecb77894cc4509766f1e486d1c02f688fccd07eed0d67b2e96bc82f1adadf9087555ae431dcc0ab5e8b492d5dc8caf962086d9ec2114d03b

  • SSDEEP

    12288:SL4mKpjv4kjqy+Xr1x/chx5n+rhqbrB8cEfN7Kwp:S467Dm6cE

Score
10/10
chaosransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 1 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-17_518177458b8b14e366b8f0cd7877d167_wannacry.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2156
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\Beni Oku !!!
    Filesize

    663B

    MD5

    5a9d6e59ec170586af58cfd1f0470d1e

    SHA1

    0e4e4aa570b0b3fc5a7c6cc6194b213f6cf3981a

    SHA256

    b1e5a9494f7a679814360b3a2155335567d56049648437f79dbcf11ec8cee0f7

    SHA512

    fe61e31602fa68de96cb7c0e9dc22704263862cd5743ddaf8e740d278a764f2453b11cb27cb60ae9ff72d993e1d3cf8991a898fd9ab854d08f7b78ed595910bb

    Download Submit

  • memory/2156-0-0x00007FFFB9073000-0x00007FFFB9075000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2156-1-0x00000000000D0000-0x000000000014E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2156-11-0x00007FFFB9070000-0x00007FFFB9B31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2156-496-0x00007FFFB9073000-0x00007FFFB9075000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2156-497-0x00007FFFB9070000-0x00007FFFB9B31000-memory.dmp

    Filesize

    10.8MB

    Download