Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 14:26

General

  • Target

    2024-11-17_46fe0bcd42e36998a93c9d6b18a06ccf_wannacry.exe

  • Size

    902KB

  • MD5

    46fe0bcd42e36998a93c9d6b18a06ccf

  • SHA1

    f451855bed6bda1a5de4b6c5a41dab2a05ddc0a4

  • SHA256

    038e1cdb5f608953303bd9c08e15a0a344f29082b60343162860ae496a33c1e6

  • SHA512

    20fc22c143cdd873a694a08324c6ce6ec4c5da34ba8fb705d9296a1484e1321811a056f5c978dcc06fc30c2ba8a812755caeed2388a67d7d20d1e0c0ac486f4c

  • SSDEEP

    6144:4AjSxpBQq0UiWm167iWm16YiWm16SiWm16cEiqmH65JiMmN6u/:i6q0UiWZiWiiWQiWWEiq1JiM8

Score
10/10

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 1 IoCs
  • Chaos family
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-17_46fe0bcd42e36998a93c9d6b18a06ccf_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-17_46fe0bcd42e36998a93c9d6b18a06ccf_wannacry.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5020-0-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

    Filesize

    8KB

  • memory/5020-1-0x00000259E8D40000-0x00000259E8E26000-memory.dmp

    Filesize

    920KB

  • memory/5020-2-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

    Filesize

    10.8MB

  • memory/5020-3-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

    Filesize

    10.8MB

  • memory/5020-4-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

    Filesize

    8KB

  • memory/5020-5-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

    Filesize

    10.8MB