Windows Analysis Report
hNgIvHRuTU.dll

Overview

General Information

Sample name: hNgIvHRuTU.dll
renamed because original name is a hash value
Original sample name: 8e6635b3dcb090c8478fc392ca94722e.dll
Analysis ID: 1592050
MD5: 8e6635b3dcb090c8478fc392ca94722e
SHA1: 937ba8b6fa1778a3fcbb3731c114c9364f7170b8
SHA256: 1fc5e4c8809b39d79324848bceac749000ea572d050c81275ae3053a83ba7d12
Tags: dllexeuser-mentality
Infos:

Detection

Wannacry
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Wannacry ransomware
AI detected suspicious sample
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Sample execution stops while process was sleeping (likely an evasion)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: hNgIvHRuTU.dll Avira: detected
Antivirus detection for URL or domain
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com//i Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8f5 Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/s Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-119b-90f6-837dd48231ad Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-12c5-b838-b08634650e Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8 Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-119b-90f6-837dd48231 Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/33ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrw Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-12c5-b838-b08634650efc Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\WINDOWS\qeriuwjhrf (copy) ReversingLabs: Detection: 85%
Source: C:\Windows\tasksche.exe ReversingLabs: Detection: 85%
Multi AV Scanner detection for submitted file
Source: hNgIvHRuTU.dll Virustotal: Detection: 93% Perma Link
Source: hNgIvHRuTU.dll ReversingLabs: Detection: 92%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.6% probability
Machine Learning detection for dropped file
Source: C:\Windows\tasksche.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: hNgIvHRuTU.dll Joe Sandbox ML: detected

Exploits
barindex
Connects to many different private IPs (likely to spread or exploit)
Source: global traffic TCP traffic: 192.168.2.39:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.38:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.42:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.41:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.44:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.43:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.46:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.45:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.48:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.47:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.40:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.28:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.27:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.29:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.31:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.30:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.33:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.32:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.35:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.34:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.37:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.36:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.17:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.16:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.19:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.18:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.20:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.22:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.21:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.24:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.23:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.26:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.25:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.97:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.96:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.11:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.99:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.10:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.98:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.13:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.12:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.15:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.14:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.91:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.90:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.93:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.92:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.95:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.94:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.2:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.1:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.8:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.7:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.9:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.4:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.3:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.6:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.5:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.86:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.104:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.85:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.105:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.88:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.102:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.87:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.103:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.108:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.89:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.109:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.106:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.107:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.80:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.82:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.100:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.81:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.101:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.84:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.83:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.75:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.74:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.77:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.113:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.76:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.114:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.79:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.78:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.71:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.111:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.70:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.112:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.73:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.72:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.110:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.64:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.63:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.66:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.65:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.68:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.67:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.69:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.60:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.62:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.61:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.49:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.53:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.52:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.55:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.54:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.57:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.56:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.59:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.58:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.51:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.50:445 Jump to behavior
Connects to many different private IPs via SMB (likely to spread or exploit)
Source: global traffic TCP traffic: 192.168.2.39:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.38:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.42:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.41:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.44:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.43:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.46:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.45:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.48:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.47:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.40:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.28:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.27:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.29:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.31:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.30:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.33:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.32:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.35:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.34:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.37:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.36:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.17:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.16:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.19:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.18:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.20:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.22:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.21:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.24:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.23:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.26:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.25:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.97:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.96:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.11:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.99:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.10:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.98:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.13:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.12:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.15:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.14:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.91:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.90:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.93:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.92:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.95:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.94:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.2:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.1:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.8:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.7:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.9:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.4:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.3:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.6:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.5:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.86:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.104:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.85:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.105:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.88:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.102:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.87:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.103:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.108:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.89:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.109:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.106:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.107:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.80:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.82:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.100:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.81:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.101:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.84:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.83:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.75:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.74:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.77:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.113:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.76:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.114:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.79:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.78:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.71:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.111:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.70:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.112:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.73:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.72:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.110:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.64:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.63:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.66:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.65:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.68:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.67:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.69:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.60:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.62:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.61:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.49:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.53:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.52:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.55:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.54:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.57:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.56:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.59:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.58:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.51:445 Jump to behavior
Source: global traffic TCP traffic: 192.168.2.50:445 Jump to behavior
Uses 32bit PE files
Source: hNgIvHRuTU.dll Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49931 version: TLS 1.0
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50283 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50373 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50638 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50639 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50640 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50641 version: TLS 1.2

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2830018 - Severity 1 - ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) : 192.168.2.5:65478 -> 1.1.1.1:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8f5 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-119b-90f6-837dd48231ad HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736959629.6434080
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-12c5-b838-b08634650efc HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=16b7b141-0abf-4f9e-8c4f-1c3090e5ffce
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49717 -> 103.224.212.215:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49720 -> 103.224.212.215:80
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49931 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8f5 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-119b-90f6-837dd48231ad HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736959629.6434080
Source: global traffic HTTP traffic detected: GET /?subid1=20250116-0347-12c5-b838-b08634650efc HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=16b7b141-0abf-4f9e-8c4f-1c3090e5ffce
Source: global traffic DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: global traffic DNS traffic detected: DNS query: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000005.00000002.2168698777.00000000009A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsoLF
Source: mssecsvr.exe, 00000007.00000002.2802700197.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000007.00000002.2802700197.0000000000C88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com//i
Source: mssecsvr.exe, 00000005.00000002.2168698777.00000000009A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/33ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrw
Source: mssecsvr.exe, 00000005.00000002.2168698777.0000000000966000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8
Source: mssecsvr.exe, 00000007.00000002.2802700197.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2802700197.0000000000CF0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-119b-90f6-837dd48231
Source: mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000D07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-12c5-b838-b08634650e
Source: mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/s
Source: hNgIvHRuTU.dll String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000005.00000002.2168698777.000000000097E000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2168698777.0000000000966000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2802700197.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/S
Source: mssecsvr.exe, 00000007.00000002.2802057332.000000000019D000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: mssecsvr.exe, 00000009.00000002.2177448708.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comc
Source: mssecsvr.exe, 00000007.00000002.2802700197.0000000000C88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comgsohB&
Source: mssecsvr.exe, 00000009.00000002.2177448708.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comyC
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50638
Source: unknown Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50639
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50373
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50638 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 50641 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50641
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50640
Source: unknown Network traffic detected: HTTP traffic on port 50373 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50283 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50373 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50638 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50639 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50640 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50641 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected Wannacry ransomware
Source: Yara match File source: hNgIvHRuTU.dll, type: SAMPLE
Source: Yara match File source: 7.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.1d7f128.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.1d4d084.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.1d5c104.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.1d580a4.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.2282948.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.mssecsvr.exe.227e8e8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.2135064930.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.2164308144.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2168405539.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2802226931.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.2156076914.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2177053960.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.2164431927.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2176853198.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.2156180423.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2168553618.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2803344917.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.2135200599.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2803025512.0000000001D5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2802339283.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: mssecsvr.exe PID: 3292, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mssecsvr.exe PID: 6640, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mssecsvr.exe PID: 2380, type: MEMORYSTR
Source: Yara match File source: C:\Windows\tasksche.exe, type: DROPPED

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: hNgIvHRuTU.dll, type: SAMPLE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: hNgIvHRuTU.dll, type: SAMPLE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d7f128.2.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d7f128.2.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d4d084.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d7f128.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d7f128.2.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d4d084.4.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d4d084.4.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d5c104.5.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d5c104.5.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d580a4.3.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d580a4.3.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.2282948.7.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2282948.7.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.227e8e8.6.unpack, type: UNPACKEDPE Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.227e8e8.6.unpack, type: UNPACKEDPE Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.2177053960.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.2164431927.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000000.2156180423.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000002.2168553618.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2803344917.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000000.2135200599.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2803025512.0000000001D5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2802339283.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\WINDOWS\mssecsvr.exe Jump to behavior
Source: C:\Windows\mssecsvr.exe File created: C:\WINDOWS\tasksche.exe Jump to behavior
Source: C:\Windows\mssecsvr.exe File created: C:\WINDOWS\tasksche.exe Jump to behavior
PE file does not import any functions
Source: tasksche.exe.5.dr Static PE information: No import functions for PE file found
Uses 32bit PE files
Source: hNgIvHRuTU.dll Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
Yara signature match
Source: hNgIvHRuTU.dll, type: SAMPLE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: hNgIvHRuTU.dll, type: SAMPLE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d7f128.2.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d7f128.2.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d4d084.4.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d7f128.2.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d7f128.2.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d5c104.5.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.2282948.7.raw.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d4d084.4.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d4d084.4.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d5c104.5.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d5c104.5.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d580a4.3.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d580a4.3.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.2282948.7.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2282948.7.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.227e8e8.6.unpack, type: UNPACKEDPE Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.227e8e8.6.unpack, type: UNPACKEDPE Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.2177053960.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.2164431927.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000000.2156180423.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000002.2168553618.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2803344917.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000000.2135200599.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2803025512.0000000001D5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2802339283.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: tasksche.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tasksche.exe.5.dr Static PE information: Section: .rdata ZLIB complexity 1.0007621951219512
Source: tasksche.exe.5.dr Static PE information: Section: .data ZLIB complexity 1.001953125
Source: tasksche.exe.5.dr Static PE information: Section: .rsrc ZLIB complexity 1.0007408405172413
Source: hNgIvHRuTU.dll, tasksche.exe.5.dr Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
Source: classification engine Classification label: mal100.rans.expl.evad.winDLL@18/2@2/100
Source: C:\Windows\mssecsvr.exe Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle, 5_2_00407C40
Source: C:\Windows\mssecsvr.exe Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle, 7_2_00407C40
Source: C:\Windows\mssecsvr.exe Code function: 5_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle, 5_2_00407CE0
Source: C:\Windows\mssecsvr.exe Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle, 5_2_00407C40
Source: C:\Windows\mssecsvr.exe Code function: 5_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA, 5_2_00408090
Source: C:\Windows\mssecsvr.exe Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA, 7_2_00408090
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3572:120:WilError_03
Source: hNgIvHRuTU.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\hNgIvHRuTU.dll,PlayGame
Source: hNgIvHRuTU.dll Virustotal: Detection: 93%
Source: hNgIvHRuTU.dll ReversingLabs: Detection: 92%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\hNgIvHRuTU.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\hNgIvHRuTU.dll,PlayGame Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",PlayGame Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: msvcp60.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: msvcp60.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: msvcp60.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\mssecsvr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: hNgIvHRuTU.dll Static file information: File size 5267459 > 1048576
Source: hNgIvHRuTU.dll Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
Source: tasksche.exe.5.dr Static PE information: section name: .text entropy: 7.64063717569669

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\SysWOW64\rundll32.exe Executable created and started: C:\WINDOWS\mssecsvr.exe Jump to behavior
Drops PE files
Source: C:\Windows\mssecsvr.exe File created: C:\WINDOWS\qeriuwjhrf (copy) Jump to dropped file
Source: C:\Windows\mssecsvr.exe File created: C:\Windows\tasksche.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\mssecsvr.exe File created: C:\WINDOWS\qeriuwjhrf (copy) Jump to dropped file
Source: C:\Windows\mssecsvr.exe File created: C:\Windows\tasksche.exe Jump to dropped file
Source: C:\Windows\mssecsvr.exe Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle, 5_2_00407C40
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\mssecsvr.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\mssecsvr.exe Thread delayed: delay time: 86400000 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\mssecsvr.exe Dropped PE file which has not been started: C:\WINDOWS\qeriuwjhrf (copy) Jump to dropped file
Source: C:\Windows\mssecsvr.exe Dropped PE file which has not been started: C:\Windows\tasksche.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\mssecsvr.exe TID: 5816 Thread sleep count: 93 > 30 Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5816 Thread sleep time: -186000s >= -30000s Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6336 Thread sleep count: 128 > 30 Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6336 Thread sleep count: 45 > 30 Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5816 Thread sleep time: -86400000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\mssecsvr.exe Thread delayed: delay time: 86400000 Jump to behavior
Source: mssecsvr.exe, 00000005.00000002.2168698777.0000000000997000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2168698777.0000000000966000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2802700197.0000000000CF0000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2802700197.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000D11000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2177448708.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hNgIvHRuTU.dll",#1 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1592050 Sample: hNgIvHRuTU.dll Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 36 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 2->36 38 ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 2->38 40 77026.bodis.com 2->40 48 Suricata IDS alerts for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 7 other signatures 2->54 9 loaddll32.exe 1 2->9         started        11 mssecsvr.exe 12 2->11         started        signatures3 process4 dnsIp5 15 rundll32.exe 9->15         started        18 cmd.exe 1 9->18         started        20 conhost.exe 9->20         started        22 rundll32.exe 1 9->22         started        42 192.168.2.102 unknown unknown 11->42 44 192.168.2.103 unknown unknown 11->44 46 98 other IPs or domains 11->46 56 Connects to many different private IPs via SMB (likely to spread or exploit) 11->56 58 Connects to many different private IPs (likely to spread or exploit) 11->58 signatures6 process7 signatures8 60 Drops executables to the windows directory (C:\Windows) and starts them 15->60 24 mssecsvr.exe 13 15->24         started        27 rundll32.exe 18->27         started        process9 file10 32 C:\WINDOWS\qeriuwjhrf (copy), PE32 24->32 dropped 29 mssecsvr.exe 13 27->29         started        process11 file12 34 C:\Windows\tasksche.exe, PE32 29->34 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
101.5.197.1
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
78.130.181.2
 unknown Bulgaria
9070 COOOLBOXBG false
78.130.181.1
 unknown Bulgaria
9070 COOOLBOXBG false
101.5.197.2
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
35.81.47.1
 unknown United States
237 MERIT-AS-14US false
13.229.164.1
 unknown United States
16509 AMAZON-02US false
13.229.164.2
 unknown United States
16509 AMAZON-02US false
25.38.30.167
 unknown United Kingdom
7922 COMCAST-7922US false
31.52.246.6
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
31.52.246.1
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
35.81.47.184
 unknown United States
237 MERIT-AS-14US false
41.240.115.2
 unknown Sudan
36998 SDN-MOBITELSD false
41.240.115.1
 unknown Sudan
36998 SDN-MOBITELSD false
126.75.17.59
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
2.139.197.109
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
129.17.117.58
 unknown United States
2841 CHALMERSSE false
218.112.212.165
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
13.229.164.57
 unknown United States
16509 AMAZON-02US false
116.101.184.130
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
129.17.117.1
 unknown United States
2841 CHALMERSSE false
144.29.150.72
 unknown United States
26258 BASF-CORPUS false
208.140.179.1
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
208.140.179.2
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
77026.bodis.com 199.59.243.228 true
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 103.224.212.215 true
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-098f-a7ce-9f0e9ab6a8f5 false
  • Avira URL Cloud: malware
 unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/ false
    		high
    http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-119b-90f6-837dd48231ad false
    • Avira URL Cloud: malware
    		 unknown
    http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0347-12c5-b838-b08634650efc false
    • Avira URL Cloud: malware
    		 unknown