Analysis
-
max time kernel
130s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 11:36
Behavioral task
behavioral1
Sample
2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe
Resource
win7-20240704-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe
-
Size
215KB
-
MD5
df40d08f46f5fd804a2e22f9a798ec53
-
SHA1
d7cf4c17b2163db3a83e7d593ca5f5681a39ce62
-
SHA256
ba29c3e7ac7e8e26bbfa8ab66ad10695379d54b2dfc4a6f6bf323e6b10c5f6ae
-
SHA512
29bccc4299b597fd23753c3d13f8118ce3bf5589e031dbaf3422cabf16a707d27e82e331a1c91489e682739d235525234150b1933b671edfa1f28a2a8e763840
-
SSDEEP
6144:S2Kr96kZBp1EvtxFzASUEEa2Xs3T/JKyL:cZBp1EvBzNUEEa2Xs3jJ
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/1116-1-0x0000000000AD0000-0x0000000000B0C000-memory.dmp family_chaos behavioral2/files/0x000a0000000233d7-6.dat family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4924 bcdedit.exe 2460 bcdedit.exe -
pid Process 4904 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation Adobe Reader.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader.url Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Adobe Reader.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BeniOku!.txt Adobe Reader.exe -
Executes dropped EXE 1 IoCs
pid Process 1976 Adobe Reader.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Links\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Adobe Reader.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Music\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Public\Documents\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Public\Music\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Adobe Reader.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Public\Videos\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Adobe Reader.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Adobe Reader.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tnspvc9nr.jpg" Adobe Reader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4584 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings Adobe Reader.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1976 Adobe Reader.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe 1976 Adobe Reader.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe Token: SeDebugPrivilege 1976 Adobe Reader.exe Token: SeBackupPrivilege 4972 vssvc.exe Token: SeRestorePrivilege 4972 vssvc.exe Token: SeAuditPrivilege 4972 vssvc.exe Token: SeIncreaseQuotaPrivilege 4936 WMIC.exe Token: SeSecurityPrivilege 4936 WMIC.exe Token: SeTakeOwnershipPrivilege 4936 WMIC.exe Token: SeLoadDriverPrivilege 4936 WMIC.exe Token: SeSystemProfilePrivilege 4936 WMIC.exe Token: SeSystemtimePrivilege 4936 WMIC.exe Token: SeProfSingleProcessPrivilege 4936 WMIC.exe Token: SeIncBasePriorityPrivilege 4936 WMIC.exe Token: SeCreatePagefilePrivilege 4936 WMIC.exe Token: SeBackupPrivilege 4936 WMIC.exe Token: SeRestorePrivilege 4936 WMIC.exe Token: SeShutdownPrivilege 4936 WMIC.exe Token: SeDebugPrivilege 4936 WMIC.exe Token: SeSystemEnvironmentPrivilege 4936 WMIC.exe Token: SeRemoteShutdownPrivilege 4936 WMIC.exe Token: SeUndockPrivilege 4936 WMIC.exe Token: SeManageVolumePrivilege 4936 WMIC.exe Token: 33 4936 WMIC.exe Token: 34 4936 WMIC.exe Token: 35 4936 WMIC.exe Token: 36 4936 WMIC.exe Token: SeIncreaseQuotaPrivilege 4936 WMIC.exe Token: SeSecurityPrivilege 4936 WMIC.exe Token: SeTakeOwnershipPrivilege 4936 WMIC.exe Token: SeLoadDriverPrivilege 4936 WMIC.exe Token: SeSystemProfilePrivilege 4936 WMIC.exe Token: SeSystemtimePrivilege 4936 WMIC.exe Token: SeProfSingleProcessPrivilege 4936 WMIC.exe Token: SeIncBasePriorityPrivilege 4936 WMIC.exe Token: SeCreatePagefilePrivilege 4936 WMIC.exe Token: SeBackupPrivilege 4936 WMIC.exe Token: SeRestorePrivilege 4936 WMIC.exe Token: SeShutdownPrivilege 4936 WMIC.exe Token: SeDebugPrivilege 4936 WMIC.exe Token: SeSystemEnvironmentPrivilege 4936 WMIC.exe Token: SeRemoteShutdownPrivilege 4936 WMIC.exe Token: SeUndockPrivilege 4936 WMIC.exe Token: SeManageVolumePrivilege 4936 WMIC.exe Token: 33 4936 WMIC.exe Token: 34 4936 WMIC.exe Token: 35 4936 WMIC.exe Token: 36 4936 WMIC.exe Token: SeBackupPrivilege 4360 wbengine.exe Token: SeRestorePrivilege 4360 wbengine.exe Token: SeSecurityPrivilege 4360 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1976 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 99 PID 1116 wrote to memory of 1976 1116 2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe 99 PID 1976 wrote to memory of 440 1976 Adobe Reader.exe 104 PID 1976 wrote to memory of 440 1976 Adobe Reader.exe 104 PID 440 wrote to memory of 4584 440 cmd.exe 106 PID 440 wrote to memory of 4584 440 cmd.exe 106 PID 440 wrote to memory of 4936 440 cmd.exe 109 PID 440 wrote to memory of 4936 440 cmd.exe 109 PID 1976 wrote to memory of 3740 1976 Adobe Reader.exe 110 PID 1976 wrote to memory of 3740 1976 Adobe Reader.exe 110 PID 3740 wrote to memory of 4924 3740 cmd.exe 112 PID 3740 wrote to memory of 4924 3740 cmd.exe 112 PID 3740 wrote to memory of 2460 3740 cmd.exe 113 PID 3740 wrote to memory of 2460 3740 cmd.exe 113 PID 1976 wrote to memory of 3564 1976 Adobe Reader.exe 114 PID 1976 wrote to memory of 3564 1976 Adobe Reader.exe 114 PID 3564 wrote to memory of 4904 3564 cmd.exe 116 PID 3564 wrote to memory of 4904 3564 cmd.exe 116 PID 1976 wrote to memory of 2052 1976 Adobe Reader.exe 120 PID 1976 wrote to memory of 2052 1976 Adobe Reader.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_df40d08f46f5fd804a2e22f9a798ec53_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Roaming\Adobe Reader.exe"C:\Users\Admin\AppData\Roaming\Adobe Reader.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4584
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:4924
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:4904
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\BeniOku!.txt3⤵PID:2052
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:81⤵PID:5076
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3060
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD5df40d08f46f5fd804a2e22f9a798ec53
SHA1d7cf4c17b2163db3a83e7d593ca5f5681a39ce62
SHA256ba29c3e7ac7e8e26bbfa8ab66ad10695379d54b2dfc4a6f6bf323e6b10c5f6ae
SHA51229bccc4299b597fd23753c3d13f8118ce3bf5589e031dbaf3422cabf16a707d27e82e331a1c91489e682739d235525234150b1933b671edfa1f28a2a8e763840
-
Filesize
998B
MD505c88b2bac44ab6d86bb3d8bd3ed0a59
SHA130727c0b9da704e7849f83a8cbeec3cd03c13229
SHA2568356bb4ee684bd4518c5e34dcda4981134a3de2b133f4e646cdf2fca57315cdd
SHA512679a8a7731b607a7e30f6ccd9576269332bc013f70b7e802d134670218b9588c940e3dcd2627c3d11529299633f6347267f13551e5849f6ecd14f37bb6947a7f