Analysis
-
max time kernel
104s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 23:54
Behavioral task
behavioral1
Sample
2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe
Resource
win10v2004-20250313-en
General
-
Target
2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe
-
Size
2.4MB
-
MD5
d3c77a381d509db6785a4d23b15d79d5
-
SHA1
1b8031147c9084068a013a7230b2adedf8a03fef
-
SHA256
f0b4cc9ca7207386fa06793a0fd2dd2b2d5a0ee019af0a7afbeb5b1665af4271
-
SHA512
0636a78a892878cc73c997d90553a358dc09c0dc6439dc5507db71b483d7b90dfd80a4b26cf0329b136bff422b8a32759a255812591390217c97beaceac416cd
-
SSDEEP
24576:lNQl+ulA8Msy1byaVJW9uyb/is+9qi/8EnTx4tTlR6:lNa+uBy1bHVJomsMqqfFKx
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/2732-1-0x0000000000770000-0x00000000009D6000-memory.dmp family_chaos behavioral2/files/0x0012000000023f6d-6.dat family_chaos -
Chaos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4456 bcdedit.exe 4404 bcdedit.exe -
pid Process 2200 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation windowsdefender.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsdefender.url windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini windowsdefender.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bruh.txt windowsdefender.exe -
Executes dropped EXE 1 IoCs
pid Process 4744 windowsdefender.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini windowsdefender.exe File opened for modification C:\Users\Public\Documents\desktop.ini windowsdefender.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1279544337-3716153908-718418795-1000\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini windowsdefender.exe File opened for modification C:\Users\Public\Desktop\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Documents\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Searches\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Videos\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini windowsdefender.exe File opened for modification C:\Users\Public\Pictures\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini windowsdefender.exe File opened for modification C:\Users\Public\Music\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini windowsdefender.exe File opened for modification C:\Users\Public\Videos\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Links\desktop.ini windowsdefender.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini windowsdefender.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49uy4u644.jpg" windowsdefender.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3848 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings windowsdefender.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5188 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4744 windowsdefender.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe 4744 windowsdefender.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe Token: SeDebugPrivilege 4744 windowsdefender.exe Token: SeBackupPrivilege 3968 vssvc.exe Token: SeRestorePrivilege 3968 vssvc.exe Token: SeAuditPrivilege 3968 vssvc.exe Token: SeIncreaseQuotaPrivilege 2676 WMIC.exe Token: SeSecurityPrivilege 2676 WMIC.exe Token: SeTakeOwnershipPrivilege 2676 WMIC.exe Token: SeLoadDriverPrivilege 2676 WMIC.exe Token: SeSystemProfilePrivilege 2676 WMIC.exe Token: SeSystemtimePrivilege 2676 WMIC.exe Token: SeProfSingleProcessPrivilege 2676 WMIC.exe Token: SeIncBasePriorityPrivilege 2676 WMIC.exe Token: SeCreatePagefilePrivilege 2676 WMIC.exe Token: SeBackupPrivilege 2676 WMIC.exe Token: SeRestorePrivilege 2676 WMIC.exe Token: SeShutdownPrivilege 2676 WMIC.exe Token: SeDebugPrivilege 2676 WMIC.exe Token: SeSystemEnvironmentPrivilege 2676 WMIC.exe Token: SeRemoteShutdownPrivilege 2676 WMIC.exe Token: SeUndockPrivilege 2676 WMIC.exe Token: SeManageVolumePrivilege 2676 WMIC.exe Token: 33 2676 WMIC.exe Token: 34 2676 WMIC.exe Token: 35 2676 WMIC.exe Token: 36 2676 WMIC.exe Token: SeIncreaseQuotaPrivilege 2676 WMIC.exe Token: SeSecurityPrivilege 2676 WMIC.exe Token: SeTakeOwnershipPrivilege 2676 WMIC.exe Token: SeLoadDriverPrivilege 2676 WMIC.exe Token: SeSystemProfilePrivilege 2676 WMIC.exe Token: SeSystemtimePrivilege 2676 WMIC.exe Token: SeProfSingleProcessPrivilege 2676 WMIC.exe Token: SeIncBasePriorityPrivilege 2676 WMIC.exe Token: SeCreatePagefilePrivilege 2676 WMIC.exe Token: SeBackupPrivilege 2676 WMIC.exe Token: SeRestorePrivilege 2676 WMIC.exe Token: SeShutdownPrivilege 2676 WMIC.exe Token: SeDebugPrivilege 2676 WMIC.exe Token: SeSystemEnvironmentPrivilege 2676 WMIC.exe Token: SeRemoteShutdownPrivilege 2676 WMIC.exe Token: SeUndockPrivilege 2676 WMIC.exe Token: SeManageVolumePrivilege 2676 WMIC.exe Token: 33 2676 WMIC.exe Token: 34 2676 WMIC.exe Token: 35 2676 WMIC.exe Token: 36 2676 WMIC.exe Token: SeBackupPrivilege 4532 wbengine.exe Token: SeRestorePrivilege 4532 wbengine.exe Token: SeSecurityPrivilege 4532 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2732 wrote to memory of 4744 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 90 PID 2732 wrote to memory of 4744 2732 2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe 90 PID 4744 wrote to memory of 4276 4744 windowsdefender.exe 95 PID 4744 wrote to memory of 4276 4744 windowsdefender.exe 95 PID 4276 wrote to memory of 3848 4276 cmd.exe 97 PID 4276 wrote to memory of 3848 4276 cmd.exe 97 PID 4276 wrote to memory of 2676 4276 cmd.exe 100 PID 4276 wrote to memory of 2676 4276 cmd.exe 100 PID 4744 wrote to memory of 4292 4744 windowsdefender.exe 101 PID 4744 wrote to memory of 4292 4744 windowsdefender.exe 101 PID 4292 wrote to memory of 4456 4292 cmd.exe 103 PID 4292 wrote to memory of 4456 4292 cmd.exe 103 PID 4292 wrote to memory of 4404 4292 cmd.exe 104 PID 4292 wrote to memory of 4404 4292 cmd.exe 104 PID 4744 wrote to memory of 5364 4744 windowsdefender.exe 105 PID 4744 wrote to memory of 5364 4744 windowsdefender.exe 105 PID 5364 wrote to memory of 2200 5364 cmd.exe 107 PID 5364 wrote to memory of 2200 5364 cmd.exe 107 PID 4744 wrote to memory of 5188 4744 windowsdefender.exe 112 PID 4744 wrote to memory of 5188 4744 windowsdefender.exe 112 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-23_d3c77a381d509db6785a4d23b15d79d5_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Roaming\windowsdefender.exe"C:\Users\Admin\AppData\Roaming\windowsdefender.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3848
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:4456
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2200
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\bruh.txt3⤵
- Opens file in notepad (likely ransom note)
PID:5188
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4928
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5068
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5d3c77a381d509db6785a4d23b15d79d5
SHA11b8031147c9084068a013a7230b2adedf8a03fef
SHA256f0b4cc9ca7207386fa06793a0fd2dd2b2d5a0ee019af0a7afbeb5b1665af4271
SHA5120636a78a892878cc73c997d90553a358dc09c0dc6439dc5507db71b483d7b90dfd80a4b26cf0329b136bff422b8a32759a255812591390217c97beaceac416cd
-
Filesize
292B
MD577718d329c0a749558fa94d4f6573036
SHA1c2e6873c2a39944ed0c779cd5c8f479862f6a6e9
SHA256e299ac3129c2dc99599080423ba6e68c3bc372b58cba6319e326f6e9266d22f1
SHA51267c227dcfcf45742a1e6bfea6f57eabbc347e864349b1cc917b2384ae8dd91d6b2702fdc863fb926707ccb54db27f1cf3001b4242220c1a5ab623151b1dd4162