Analysis
-
max time kernel
103s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2025, 05:30
Behavioral task
behavioral1
Sample
2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe
-
Size
447KB
-
MD5
52591bcd3ece758cdd181f70d9ef1543
-
SHA1
26b8b245dd637acef02755c20649d75da01fb553
-
SHA256
1c79542da7977748a757510d2a7e5422d0fd2fb6bf0b3f978dfdaa47a352ddf2
-
SHA512
48c7bd824f3d426f47b6ca946112102b1a1775a604aa2c6924c770a4e9f58bc680421dd894bb0de6c57e4a2eb4d9208c66a18c3122f386d994eb6d273b64e19b
-
SSDEEP
12288:KO4cpG0FBzdHVic/AI2qY2U3Kk9K642BBTFKIrfWFYcUT:XY86HRcqc4
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral1/memory/1680-1-0x0000000000C20000-0x0000000000C96000-memory.dmp family_chaos behavioral1/files/0x000c00000001e689-6.dat family_chaos -
Chaos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3500 bcdedit.exe 4136 bcdedit.exe -
pid Process 5480 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation last.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\last.url last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini last.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\666.666.666.txt last.exe -
Executes dropped EXE 1 IoCs
pid Process 5584 last.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini last.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini last.exe File opened for modification C:\Users\Public\Pictures\desktop.ini last.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini last.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini last.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini last.exe File opened for modification C:\Users\Admin\Music\desktop.ini last.exe File opened for modification C:\Users\Public\Documents\desktop.ini last.exe File opened for modification C:\Users\Public\Music\desktop.ini last.exe File opened for modification C:\Users\Public\Desktop\desktop.ini last.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini last.exe File opened for modification C:\Users\Admin\Links\desktop.ini last.exe File opened for modification C:\Users\Admin\Documents\desktop.ini last.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini last.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini last.exe File opened for modification C:\Users\Public\Videos\desktop.ini last.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini last.exe File opened for modification C:\Users\Admin\Searches\desktop.ini last.exe File opened for modification C:\Users\Admin\Videos\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini last.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini last.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini last.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini last.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini last.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8ydj2sx0a.jpg" last.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2516 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings last.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4048 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5584 last.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe 5584 last.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe Token: SeDebugPrivilege 5584 last.exe Token: SeBackupPrivilege 3652 vssvc.exe Token: SeRestorePrivilege 3652 vssvc.exe Token: SeAuditPrivilege 3652 vssvc.exe Token: SeIncreaseQuotaPrivilege 8 WMIC.exe Token: SeSecurityPrivilege 8 WMIC.exe Token: SeTakeOwnershipPrivilege 8 WMIC.exe Token: SeLoadDriverPrivilege 8 WMIC.exe Token: SeSystemProfilePrivilege 8 WMIC.exe Token: SeSystemtimePrivilege 8 WMIC.exe Token: SeProfSingleProcessPrivilege 8 WMIC.exe Token: SeIncBasePriorityPrivilege 8 WMIC.exe Token: SeCreatePagefilePrivilege 8 WMIC.exe Token: SeBackupPrivilege 8 WMIC.exe Token: SeRestorePrivilege 8 WMIC.exe Token: SeShutdownPrivilege 8 WMIC.exe Token: SeDebugPrivilege 8 WMIC.exe Token: SeSystemEnvironmentPrivilege 8 WMIC.exe Token: SeRemoteShutdownPrivilege 8 WMIC.exe Token: SeUndockPrivilege 8 WMIC.exe Token: SeManageVolumePrivilege 8 WMIC.exe Token: 33 8 WMIC.exe Token: 34 8 WMIC.exe Token: 35 8 WMIC.exe Token: 36 8 WMIC.exe Token: SeIncreaseQuotaPrivilege 8 WMIC.exe Token: SeSecurityPrivilege 8 WMIC.exe Token: SeTakeOwnershipPrivilege 8 WMIC.exe Token: SeLoadDriverPrivilege 8 WMIC.exe Token: SeSystemProfilePrivilege 8 WMIC.exe Token: SeSystemtimePrivilege 8 WMIC.exe Token: SeProfSingleProcessPrivilege 8 WMIC.exe Token: SeIncBasePriorityPrivilege 8 WMIC.exe Token: SeCreatePagefilePrivilege 8 WMIC.exe Token: SeBackupPrivilege 8 WMIC.exe Token: SeRestorePrivilege 8 WMIC.exe Token: SeShutdownPrivilege 8 WMIC.exe Token: SeDebugPrivilege 8 WMIC.exe Token: SeSystemEnvironmentPrivilege 8 WMIC.exe Token: SeRemoteShutdownPrivilege 8 WMIC.exe Token: SeUndockPrivilege 8 WMIC.exe Token: SeManageVolumePrivilege 8 WMIC.exe Token: 33 8 WMIC.exe Token: 34 8 WMIC.exe Token: 35 8 WMIC.exe Token: 36 8 WMIC.exe Token: SeBackupPrivilege 4000 wbengine.exe Token: SeRestorePrivilege 4000 wbengine.exe Token: SeSecurityPrivilege 4000 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1680 wrote to memory of 5584 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 97 PID 1680 wrote to memory of 5584 1680 2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe 97 PID 5584 wrote to memory of 220 5584 last.exe 101 PID 5584 wrote to memory of 220 5584 last.exe 101 PID 220 wrote to memory of 2516 220 cmd.exe 103 PID 220 wrote to memory of 2516 220 cmd.exe 103 PID 220 wrote to memory of 8 220 cmd.exe 107 PID 220 wrote to memory of 8 220 cmd.exe 107 PID 5584 wrote to memory of 2964 5584 last.exe 108 PID 5584 wrote to memory of 2964 5584 last.exe 108 PID 2964 wrote to memory of 3500 2964 cmd.exe 110 PID 2964 wrote to memory of 3500 2964 cmd.exe 110 PID 2964 wrote to memory of 4136 2964 cmd.exe 111 PID 2964 wrote to memory of 4136 2964 cmd.exe 111 PID 5584 wrote to memory of 5652 5584 last.exe 112 PID 5584 wrote to memory of 5652 5584 last.exe 112 PID 5652 wrote to memory of 5480 5652 cmd.exe 114 PID 5652 wrote to memory of 5480 5652 cmd.exe 114 PID 5584 wrote to memory of 4048 5584 last.exe 119 PID 5584 wrote to memory of 4048 5584 last.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-04_52591bcd3ece758cdd181f70d9ef1543_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Roaming\last.exe"C:\Users\Admin\AppData\Roaming\last.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2516
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3500
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:5480
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\666.666.666.txt3⤵
- Opens file in notepad (likely ransom note)
PID:4048
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1824
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:520
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
447KB
MD552591bcd3ece758cdd181f70d9ef1543
SHA126b8b245dd637acef02755c20649d75da01fb553
SHA2561c79542da7977748a757510d2a7e5422d0fd2fb6bf0b3f978dfdaa47a352ddf2
SHA51248c7bd824f3d426f47b6ca946112102b1a1775a604aa2c6924c770a4e9f58bc680421dd894bb0de6c57e4a2eb4d9208c66a18c3122f386d994eb6d273b64e19b
-
Filesize
15B
MD527ed32e13514afa9c7a9284720b7ab87
SHA1d00af4be4913d688862e93e6612636cc592cc039
SHA256df6768cb61daf32ef7c4ee167c2f58c32796b7b4b3394354c12fcf2ad4197896
SHA51210eee241bc2c9f9d720b8dd0432d95f8809e17d650b1a2ffde026086d1c70f6797c291bddcfa128b3aae289aa81525c1bc521e55f8a8b6799bc71f6c30a6c589