Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 21:20
Behavioral task
behavioral1
Sample
20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe
-
Size
223KB
-
MD5
d0253f9a0ee3f89546f90008ece430a9
-
SHA1
613bb8ebd45f3fe9157ae8eaeb4e53e4afc82b7a
-
SHA256
09fcfbd144a75f75a40934b341ec3d1248b9229f7757199b61c03fbe4a9d2187
-
SHA512
2862a0966167ed705aaf9d51b144a0f087829d2a3d9e09bb46539a293654c5cb3635565f6ce930dbad52118029332b96917d0573d2aa567fd00d78869b53f1f3
-
SSDEEP
6144:ICSO0ZJJchBRsZV7yc9CZBp1EvtxFzASUEEa2Xs3T:Iln2bKkZBp1EvBzNUEEa2Xs3
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 1 IoCs
resource yara_rule behavioral1/memory/2432-1-0x00000000002C0000-0x00000000002FE000-memory.dmp family_chaos -
Loads dropped DLL 1 IoCs
pid Process 2432 20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2432 20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe 2432 20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe 2432 20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2432 20240824d0253f9a0ee3f89546f90008ece430a9wannacry.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5d80d1b6d9a6d5986fa47f6f8487030e1
SHA18f5773bf9eca43b079c1766b2e9f44cc90bd9215
SHA256446128f1712da8064d0197376184315cb529ed26ed9122f7b171bb208e22c0c3
SHA5129fcf0105c2c9ee81c526d41633d93579bb8e2837989d77fb4a6523440415ec2d7fa46ac9ae4e55ecebd99126837817ac308cc079475de02667b21727a43d74cc