Overview

overview

10

Static

static

10

2025-01-10...ry.exe

windows7-x64

10

2025-01-10...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2025, 01:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-01-10_098bdcd33912b17a7641ab7affdeea84_wannacry.exe
  • Size 520KB
  • Sample250110-b7tkvsxngy
  • SHA256 e019c6f094965c3bccc0a7ba09bfb09c4ff7059795da5b66b6e7a7c0ac8ef7ef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\read_it.txt

Ransom Note
  • ~~~LucKY_Gh0$t~~~ >>>> All your important files are encrypted !!! The data will not be decrypted if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Contact: Download and install SESSION (https://getsession.org) Our SESSION id: 05e18b4f1919469a2581ec63e75edee4f9be440bde926cf1cc3aedf1115ade5655 Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. >>>> Your personal DECRYPTION ID: U0001 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

  • https://getsession.org

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-10_098bdcd33912b17a7641ab7affdeea84_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-10_098bdcd33912b17a7641ab7affdeea84_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1120

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2025-01-10_098bdcd33912b17a7641ab7affdeea84_wannacry.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2025-01-10_098bdcd33912b17a7641ab7affdeea84_wannacry.exe.log
        • Size 226B
        • SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
        • MD5 SHA1 SHA512
        Submit Download

        read_it.txt
        • Path C:\Users\Admin\AppData\Local\read_it.txt
        • Size 1KB
        • SHA256 02354567f25b75e9861a6ce9d7f6fb52984b1f7ab40d1a5d61f1bead7db915c7
        • MD5 SHA1 SHA512
        Submit Download

        ClearProtect.xls
        • Path C:\Users\Admin\AppData\Roaming\ClearProtect.xls
        • Size 1B
        • SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
        • MD5 SHA1 SHA512
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\svchost.exe
        • Size 520KB
        • SHA256 e019c6f094965c3bccc0a7ba09bfb09c4ff7059795da5b66b6e7a7c0ac8ef7ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2584-0-0x00007FFB1AC13000-0x00007FFB1AC15000-memory.dmp
        Download

        memory/2584-1-0x0000000000C20000-0x0000000000CA6000-memory.dmp
        Download

        memory/3760-14-0x00007FFB1AC10000-0x00007FFB1B6D1000-memory.dmp
        Download

        memory/3760-1187-0x00007FFB1AC10000-0x00007FFB1B6D1000-memory.dmp
        Download