| File name: | 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry |
| Full analysis: | https://app.any.run/tasks/435f5ab3-6b45-4bd2-bd92-9d3d324f5f29 |
| Verdict: | Malicious activity |
| Threats: | BlackMatter is a ransomware strain operating as a Ransomware-as-a-Service (RaaS), designed to encrypt files, remove recovery options, and extort victims across critical industries. Emerging in 2021, it quickly became a major concern due to its ability to evade defenses, spread across networks, and cause large-scale operational disruption, forcing security teams to act against a highly destructive and persistent threat. |
| Analysis date: | June 21, 2025, 21:56:34 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 34828F7BDA1392A648369CFE76E10CBA |
| SHA1: | 56AE2E1B5F19DFF15894AF02B2605A9C5DEE63DB |
| SHA256: | 059A442C795180D2B0303D07C416CEBC68632EA84A2DAEC04ED396E7CF63CF92 |
| SSDEEP: | 1536:a1FFnXM+rz0WS2QfrEjlga11n/oHniAeOxXNC8Sf9IaXiQkUS:a1FFnXM+rz0WSjpnSf9IaXioS |
MALICIOUS
BLACKMATTER mutex has been found
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Uses Task Scheduler to autorun other applications
- svchost.exe (PID: 724)
Changes the autorun value in the registry
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Deletes shadow copies
- svchost.exe (PID: 724)
- cmd.exe (PID: 6940)
- cmd.exe (PID: 4192)
- update_uxIvoO.exe (PID: 4460)
- cmd.exe (PID: 3872)
- cmd.exe (PID: 2708)
Starts NET.EXE for service management
- net.exe (PID: 1356)
- svchost.exe (PID: 724)
- net.exe (PID: 188)
- net.exe (PID: 1232)
- net.exe (PID: 1136)
- net.exe (PID: 4880)
- net.exe (PID: 5692)
- net.exe (PID: 3836)
- net.exe (PID: 2032)
- net.exe (PID: 3580)
- net.exe (PID: 4960)
- net.exe (PID: 1932)
- net.exe (PID: 4888)
- net.exe (PID: 3876)
- net.exe (PID: 5060)
- net.exe (PID: 4884)
- net.exe (PID: 1564)
- net.exe (PID: 6268)
- net.exe (PID: 2512)
- net.exe (PID: 3396)
- net.exe (PID: 5560)
- net.exe (PID: 3396)
- net.exe (PID: 1564)
- net.exe (PID: 2148)
- net.exe (PID: 6256)
- net.exe (PID: 1380)
- update_uxIvoO.exe (PID: 4460)
- net.exe (PID: 2192)
- net.exe (PID: 1932)
- net.exe (PID: 1752)
- net.exe (PID: 2272)
- net.exe (PID: 2708)
- net.exe (PID: 6256)
- net.exe (PID: 2528)
- net.exe (PID: 4816)
- net.exe (PID: 3504)
- net.exe (PID: 4456)
- net.exe (PID: 6176)
- net.exe (PID: 1328)
- net.exe (PID: 3936)
- net.exe (PID: 1760)
- net.exe (PID: 6640)
- net.exe (PID: 4844)
- net.exe (PID: 3388)
- net.exe (PID: 4040)
- net.exe (PID: 3844)
- net.exe (PID: 3100)
- net.exe (PID: 3748)
- net.exe (PID: 3948)
- net.exe (PID: 592)
- net.exe (PID: 4192)
- net.exe (PID: 4172)
- net.exe (PID: 3760)
- net.exe (PID: 1508)
- net.exe (PID: 592)
- net.exe (PID: 2620)
- net.exe (PID: 6216)
- net.exe (PID: 4864)
- net.exe (PID: 6656)
- net.exe (PID: 2272)
- net.exe (PID: 1208)
- net.exe (PID: 416)
- net.exe (PID: 6656)
- net.exe (PID: 6492)
- net.exe (PID: 7456)
- net.exe (PID: 7480)
- net.exe (PID: 7848)
- net.exe (PID: 7856)
- net.exe (PID: 1932)
- net.exe (PID: 4816)
- net.exe (PID: 7596)
- net.exe (PID: 7568)
- net.exe (PID: 7920)
- net.exe (PID: 7960)
- net.exe (PID: 4816)
- net.exe (PID: 7360)
- net.exe (PID: 7484)
- net.exe (PID: 7816)
- net.exe (PID: 3748)
- net.exe (PID: 8132)
- net.exe (PID: 8156)
- net.exe (PID: 7436)
- net.exe (PID: 7536)
- net.exe (PID: 3608)
- net.exe (PID: 7484)
- net.exe (PID: 7936)
- net.exe (PID: 3760)
- net.exe (PID: 5600)
- net.exe (PID: 6492)
- net.exe (PID: 7304)
- net.exe (PID: 7288)
- net.exe (PID: 5968)
- net.exe (PID: 7996)
- net.exe (PID: 7916)
- net.exe (PID: 7756)
- net.exe (PID: 7824)
- net.exe (PID: 7476)
- net.exe (PID: 7952)
- net.exe (PID: 7440)
- net.exe (PID: 7192)
- net.exe (PID: 7524)
- net.exe (PID: 3620)
- net.exe (PID: 8040)
- net.exe (PID: 1932)
- net.exe (PID: 7364)
- net.exe (PID: 4156)
- net.exe (PID: 1752)
- net.exe (PID: 4512)
- net.exe (PID: 7884)
- net.exe (PID: 4664)
- net.exe (PID: 5476)
- net.exe (PID: 7428)
- net.exe (PID: 7288)
- net.exe (PID: 7496)
- net.exe (PID: 7704)
- net.exe (PID: 4844)
- net.exe (PID: 3388)
- net.exe (PID: 6640)
- net.exe (PID: 2124)
- net.exe (PID: 4692)
- net.exe (PID: 3736)
- net.exe (PID: 6948)
- net.exe (PID: 7772)
- net.exe (PID: 504)
- net.exe (PID: 4836)
- net.exe (PID: 7560)
- net.exe (PID: 5720)
- net.exe (PID: 6704)
- net.exe (PID: 7972)
- net.exe (PID: 4324)
- net.exe (PID: 7212)
- net.exe (PID: 7812)
- net.exe (PID: 7876)
- net.exe (PID: 5372)
- net.exe (PID: 8076)
- net.exe (PID: 7416)
- net.exe (PID: 4196)
- net.exe (PID: 4816)
- net.exe (PID: 7828)
- net.exe (PID: 6140)
- net.exe (PID: 4224)
- net.exe (PID: 1212)
- net.exe (PID: 5368)
- net.exe (PID: 6548)
- net.exe (PID: 7452)
- net.exe (PID: 3736)
- net.exe (PID: 3396)
- net.exe (PID: 2972)
- net.exe (PID: 5372)
- net.exe (PID: 7544)
- net.exe (PID: 7396)
- net.exe (PID: 7412)
- net.exe (PID: 5432)
- net.exe (PID: 5720)
- net.exe (PID: 2076)
- net.exe (PID: 6956)
- net.exe (PID: 3976)
- net.exe (PID: 7692)
- net.exe (PID: 7972)
- net.exe (PID: 2128)
- net.exe (PID: 7264)
- net.exe (PID: 3944)
- net.exe (PID: 6460)
- net.exe (PID: 3760)
- net.exe (PID: 8000)
- net.exe (PID: 3976)
- net.exe (PID: 7856)
- net.exe (PID: 5288)
- net.exe (PID: 7752)
- net.exe (PID: 7580)
- net.exe (PID: 5432)
- net.exe (PID: 472)
- net.exe (PID: 3872)
- net.exe (PID: 5172)
- net.exe (PID: 3936)
- net.exe (PID: 7512)
- net.exe (PID: 7532)
- net.exe (PID: 592)
- net.exe (PID: 7656)
- net.exe (PID: 3972)
- net.exe (PID: 1948)
- net.exe (PID: 2620)
- net.exe (PID: 5780)
- net.exe (PID: 7748)
- net.exe (PID: 7872)
- net.exe (PID: 1872)
- net.exe (PID: 4880)
- net.exe (PID: 472)
- net.exe (PID: 7336)
- net.exe (PID: 2368)
- net.exe (PID: 7252)
- net.exe (PID: 7692)
- net.exe (PID: 5600)
- net.exe (PID: 3872)
- net.exe (PID: 7788)
- net.exe (PID: 1096)
- net.exe (PID: 4844)
- net.exe (PID: 8136)
- net.exe (PID: 6256)
- net.exe (PID: 8120)
- net.exe (PID: 3872)
- net.exe (PID: 3736)
- net.exe (PID: 4380)
- net.exe (PID: 5600)
- net.exe (PID: 3936)
- net.exe (PID: 6772)
- net.exe (PID: 3972)
- net.exe (PID: 7724)
- net.exe (PID: 7608)
- net.exe (PID: 7656)
- net.exe (PID: 6956)
- net.exe (PID: 4040)
- net.exe (PID: 7172)
- net.exe (PID: 7436)
- net.exe (PID: 4048)
- net.exe (PID: 1728)
- net.exe (PID: 7644)
- net.exe (PID: 4444)
- net.exe (PID: 7436)
- net.exe (PID: 3836)
- net.exe (PID: 7608)
- net.exe (PID: 4380)
- net.exe (PID: 3836)
- net.exe (PID: 5372)
- net.exe (PID: 7724)
- net.exe (PID: 8032)
- net.exe (PID: 4844)
- net.exe (PID: 2148)
- net.exe (PID: 7656)
- net.exe (PID: 592)
- net.exe (PID: 1948)
- net.exe (PID: 2512)
- net.exe (PID: 7608)
- net.exe (PID: 7004)
- net.exe (PID: 7172)
- net.exe (PID: 5372)
- net.exe (PID: 1568)
- net.exe (PID: 5372)
- net.exe (PID: 7444)
- net.exe (PID: 8148)
- net.exe (PID: 8148)
- net.exe (PID: 8068)
- net.exe (PID: 7988)
- net.exe (PID: 7316)
- net.exe (PID: 7316)
- net.exe (PID: 1868)
- net.exe (PID: 2708)
- net.exe (PID: 1868)
- net.exe (PID: 5988)
- net.exe (PID: 4036)
- net.exe (PID: 7444)
- net.exe (PID: 5372)
- net.exe (PID: 7972)
- net.exe (PID: 8136)
- net.exe (PID: 7400)
- net.exe (PID: 7856)
- net.exe (PID: 9092)
- net.exe (PID: 8328)
- net.exe (PID: 8536)
- net.exe (PID: 8748)
- net.exe (PID: 8640)
- net.exe (PID: 8212)
- net.exe (PID: 8336)
- net.exe (PID: 8380)
- net.exe (PID: 8436)
- net.exe (PID: 9044)
- net.exe (PID: 5032)
- net.exe (PID: 7040)
- net.exe (PID: 8484)
- net.exe (PID: 2160)
- net.exe (PID: 6664)
- net.exe (PID: 7120)
- net.exe (PID: 9164)
- net.exe (PID: 8000)
- net.exe (PID: 2288)
- net.exe (PID: 8124)
- net.exe (PID: 9020)
- net.exe (PID: 8464)
Using BCDEDIT.EXE to modify recovery options
- cmd.exe (PID: 4552)
- cmd.exe (PID: 6140)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Bypass User Account Control (Modify registry)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts NET.EXE to view/change shared resources
- svchost.exe (PID: 724)
- net.exe (PID: 7632)
- net.exe (PID: 8236)
- update_uxIvoO.exe (PID: 4460)
Changes powershell execution policy (Bypass)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Bypass execution policy to execute commands
- powershell.exe (PID: 8908)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 8740)
- powershell.exe (PID: 9016)
Uses Task Scheduler to run other applications
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts SC.EXE for service management
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts REAGENTC.EXE to disable the Windows Recovery Environment
- ReAgentc.exe (PID: 8296)
- ReAgentc.exe (PID: 1236)
SUSPICIOUS
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 7032)
- cmd.exe (PID: 2804)
- cmd.exe (PID: 4888)
- cmd.exe (PID: 416)
- cmd.exe (PID: 3888)
- cmd.exe (PID: 4192)
- cmd.exe (PID: 4320)
- cmd.exe (PID: 4868)
- cmd.exe (PID: 5780)
- cmd.exe (PID: 6656)
- cmd.exe (PID: 1932)
- cmd.exe (PID: 3100)
- cmd.exe (PID: 6360)
- cmd.exe (PID: 6388)
- cmd.exe (PID: 4916)
- cmd.exe (PID: 4888)
- cmd.exe (PID: 6948)
Starts CMD.EXE for commands execution
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Executing commands from a ".bat" file
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Executable content was dropped or overwritten
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
The process creates files with name similar to system file names
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
Reads security settings of Internet Explorer
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Reads the date of Windows installation
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts itself from another location
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
Changes default file association
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts SC.EXE for service management
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Windows service management via SC.EXE
- sc.exe (PID: 424)
- sc.exe (PID: 5504)
- sc.exe (PID: 5116)
- sc.exe (PID: 4104)
- sc.exe (PID: 1568)
- sc.exe (PID: 1512)
- sc.exe (PID: 6772)
- sc.exe (PID: 5556)
- sc.exe (PID: 4688)
- sc.exe (PID: 6876)
- sc.exe (PID: 2216)
- sc.exe (PID: 5564)
- sc.exe (PID: 5612)
- sc.exe (PID: 4552)
- sc.exe (PID: 6636)
- sc.exe (PID: 2120)
- sc.exe (PID: 1212)
- sc.exe (PID: 4836)
- sc.exe (PID: 3620)
- sc.exe (PID: 3584)
- sc.exe (PID: 4684)
- sc.exe (PID: 4084)
- sc.exe (PID: 4032)
- sc.exe (PID: 6540)
- sc.exe (PID: 3624)
- sc.exe (PID: 6372)
- sc.exe (PID: 4580)
- sc.exe (PID: 6104)
- sc.exe (PID: 5968)
- sc.exe (PID: 2524)
- sc.exe (PID: 6664)
- sc.exe (PID: 6548)
- sc.exe (PID: 5288)
- sc.exe (PID: 5896)
- sc.exe (PID: 1812)
- sc.exe (PID: 6180)
- sc.exe (PID: 7116)
- sc.exe (PID: 1496)
- sc.exe (PID: 5780)
- sc.exe (PID: 2792)
- sc.exe (PID: 5600)
- sc.exe (PID: 5496)
- sc.exe (PID: 6380)
- sc.exe (PID: 1232)
- sc.exe (PID: 2044)
- sc.exe (PID: 7032)
- sc.exe (PID: 5720)
- sc.exe (PID: 1136)
- sc.exe (PID: 3908)
- sc.exe (PID: 472)
- sc.exe (PID: 5908)
- sc.exe (PID: 1564)
- sc.exe (PID: 6732)
- sc.exe (PID: 3872)
- sc.exe (PID: 1700)
- sc.exe (PID: 1872)
- sc.exe (PID: 2536)
- sc.exe (PID: 4760)
- sc.exe (PID: 3724)
- sc.exe (PID: 2512)
- sc.exe (PID: 4808)
- sc.exe (PID: 5172)
- sc.exe (PID: 4916)
- sc.exe (PID: 7072)
- sc.exe (PID: 3196)
- sc.exe (PID: 4156)
- sc.exe (PID: 1752)
- sc.exe (PID: 2552)
- sc.exe (PID: 2116)
- sc.exe (PID: 2232)
- sc.exe (PID: 1472)
- sc.exe (PID: 1180)
- sc.exe (PID: 6260)
- sc.exe (PID: 4236)
- sc.exe (PID: 6256)
- sc.exe (PID: 3504)
- sc.exe (PID: 5084)
- sc.exe (PID: 4692)
- sc.exe (PID: 2368)
- sc.exe (PID: 4060)
- sc.exe (PID: 6140)
- sc.exe (PID: 4324)
- sc.exe (PID: 3836)
- sc.exe (PID: 1132)
- sc.exe (PID: 5432)
- sc.exe (PID: 3720)
- sc.exe (PID: 4456)
- sc.exe (PID: 2356)
- sc.exe (PID: 7092)
- sc.exe (PID: 6376)
- sc.exe (PID: 6320)
- sc.exe (PID: 6768)
- sc.exe (PID: 2580)
- sc.exe (PID: 4040)
- sc.exe (PID: 5824)
- sc.exe (PID: 3672)
- sc.exe (PID: 4844)
- sc.exe (PID: 4984)
- sc.exe (PID: 1216)
- sc.exe (PID: 4192)
- sc.exe (PID: 5400)
- sc.exe (PID: 1044)
- sc.exe (PID: 1328)
- sc.exe (PID: 3844)
- sc.exe (PID: 4172)
- sc.exe (PID: 4664)
- sc.exe (PID: 3100)
- sc.exe (PID: 6268)
- sc.exe (PID: 6388)
- sc.exe (PID: 4512)
- sc.exe (PID: 6128)
- sc.exe (PID: 1052)
- sc.exe (PID: 7052)
- sc.exe (PID: 2620)
- sc.exe (PID: 6172)
- sc.exe (PID: 3948)
- sc.exe (PID: 1296)
- sc.exe (PID: 6216)
- sc.exe (PID: 3760)
- sc.exe (PID: 7192)
- sc.exe (PID: 7264)
- sc.exe (PID: 7320)
- sc.exe (PID: 7384)
- sc.exe (PID: 2952)
- sc.exe (PID: 7768)
- sc.exe (PID: 8008)
- sc.exe (PID: 8028)
- sc.exe (PID: 8124)
- sc.exe (PID: 8140)
- sc.exe (PID: 7332)
- sc.exe (PID: 7308)
- sc.exe (PID: 7440)
- sc.exe (PID: 7516)
- sc.exe (PID: 7696)
- sc.exe (PID: 7808)
- sc.exe (PID: 7644)
- sc.exe (PID: 7620)
- sc.exe (PID: 7720)
- sc.exe (PID: 7892)
- sc.exe (PID: 7172)
- sc.exe (PID: 8180)
- sc.exe (PID: 7252)
- sc.exe (PID: 7256)
- sc.exe (PID: 7432)
- sc.exe (PID: 7540)
- sc.exe (PID: 7700)
- sc.exe (PID: 7688)
- sc.exe (PID: 7852)
- sc.exe (PID: 7996)
- sc.exe (PID: 8008)
- sc.exe (PID: 7032)
- sc.exe (PID: 6104)
- sc.exe (PID: 5712)
- sc.exe (PID: 6304)
- sc.exe (PID: 7224)
- sc.exe (PID: 3520)
- sc.exe (PID: 7588)
- sc.exe (PID: 7708)
- sc.exe (PID: 7652)
- sc.exe (PID: 3964)
- sc.exe (PID: 7948)
- sc.exe (PID: 8140)
- sc.exe (PID: 5720)
- sc.exe (PID: 7800)
- sc.exe (PID: 3572)
- sc.exe (PID: 6876)
- sc.exe (PID: 7048)
- sc.exe (PID: 1136)
- sc.exe (PID: 424)
- sc.exe (PID: 8136)
- sc.exe (PID: 3908)
- sc.exe (PID: 8132)
- sc.exe (PID: 7360)
- sc.exe (PID: 7392)
- sc.exe (PID: 5992)
- sc.exe (PID: 4224)
- sc.exe (PID: 188)
- sc.exe (PID: 8108)
- sc.exe (PID: 7816)
- sc.exe (PID: 1520)
- sc.exe (PID: 2120)
- sc.exe (PID: 4684)
- sc.exe (PID: 7404)
- sc.exe (PID: 7624)
- sc.exe (PID: 7536)
- sc.exe (PID: 6540)
- sc.exe (PID: 5560)
- sc.exe (PID: 3980)
- sc.exe (PID: 7048)
- sc.exe (PID: 6176)
- sc.exe (PID: 7700)
- sc.exe (PID: 6980)
- sc.exe (PID: 7424)
- sc.exe (PID: 6004)
- sc.exe (PID: 7844)
- sc.exe (PID: 7792)
- sc.exe (PID: 7736)
- sc.exe (PID: 3588)
- sc.exe (PID: 7508)
- sc.exe (PID: 8080)
- sc.exe (PID: 7344)
- sc.exe (PID: 6676)
- sc.exe (PID: 1812)
- sc.exe (PID: 6636)
- sc.exe (PID: 3624)
- sc.exe (PID: 7140)
- sc.exe (PID: 1044)
- sc.exe (PID: 1056)
- sc.exe (PID: 6348)
- sc.exe (PID: 4236)
- sc.exe (PID: 7984)
- sc.exe (PID: 7880)
- sc.exe (PID: 7696)
- sc.exe (PID: 2380)
- sc.exe (PID: 4984)
- sc.exe (PID: 2952)
- sc.exe (PID: 7636)
- sc.exe (PID: 7524)
- sc.exe (PID: 5712)
- sc.exe (PID: 7180)
- sc.exe (PID: 7236)
- sc.exe (PID: 6492)
- sc.exe (PID: 7304)
- sc.exe (PID: 5876)
- sc.exe (PID: 2296)
- sc.exe (PID: 1488)
- sc.exe (PID: 7052)
- sc.exe (PID: 7960)
- sc.exe (PID: 632)
- sc.exe (PID: 7328)
- sc.exe (PID: 6808)
- sc.exe (PID: 6128)
- sc.exe (PID: 4172)
- sc.exe (PID: 4104)
- sc.exe (PID: 620)
- sc.exe (PID: 7324)
- sc.exe (PID: 7672)
- sc.exe (PID: 7764)
- sc.exe (PID: 1472)
- sc.exe (PID: 5992)
- sc.exe (PID: 7220)
- sc.exe (PID: 6160)
- sc.exe (PID: 7940)
- sc.exe (PID: 7484)
- sc.exe (PID: 1100)
- sc.exe (PID: 1480)
- sc.exe (PID: 6504)
- sc.exe (PID: 7924)
- sc.exe (PID: 7936)
- sc.exe (PID: 4116)
- sc.exe (PID: 7952)
- sc.exe (PID: 7552)
- sc.exe (PID: 6216)
- sc.exe (PID: 8072)
- sc.exe (PID: 7716)
- sc.exe (PID: 7628)
- sc.exe (PID: 7896)
- sc.exe (PID: 4324)
- sc.exe (PID: 3388)
- sc.exe (PID: 7504)
- sc.exe (PID: 7884)
- sc.exe (PID: 1800)
- sc.exe (PID: 4032)
- sc.exe (PID: 5564)
- sc.exe (PID: 8172)
- sc.exe (PID: 7240)
- sc.exe (PID: 7592)
- sc.exe (PID: 4512)
- sc.exe (PID: 6388)
- sc.exe (PID: 6376)
- sc.exe (PID: 4084)
- sc.exe (PID: 7464)
- sc.exe (PID: 7468)
- sc.exe (PID: 7616)
- sc.exe (PID: 7968)
- sc.exe (PID: 8028)
- sc.exe (PID: 1192)
- sc.exe (PID: 5556)
- sc.exe (PID: 4808)
- sc.exe (PID: 7964)
- sc.exe (PID: 6668)
- sc.exe (PID: 7620)
- sc.exe (PID: 5476)
- sc.exe (PID: 7308)
- sc.exe (PID: 8040)
- sc.exe (PID: 5644)
- sc.exe (PID: 7928)
- sc.exe (PID: 3100)
- sc.exe (PID: 4700)
- sc.exe (PID: 6016)
- sc.exe (PID: 5368)
- sc.exe (PID: 1232)
- sc.exe (PID: 8152)
- sc.exe (PID: 4196)
- sc.exe (PID: 7900)
- sc.exe (PID: 4892)
- sc.exe (PID: 7472)
- sc.exe (PID: 7876)
- sc.exe (PID: 7072)
- sc.exe (PID: 6548)
- sc.exe (PID: 1932)
- sc.exe (PID: 3924)
- sc.exe (PID: 6704)
- sc.exe (PID: 6756)
- sc.exe (PID: 3964)
- sc.exe (PID: 3956)
- sc.exe (PID: 6268)
- sc.exe (PID: 8052)
- sc.exe (PID: 8048)
- sc.exe (PID: 7564)
- sc.exe (PID: 6656)
- sc.exe (PID: 7712)
- sc.exe (PID: 7416)
- sc.exe (PID: 7812)
- sc.exe (PID: 7272)
- sc.exe (PID: 7772)
- sc.exe (PID: 6140)
- sc.exe (PID: 7268)
- sc.exe (PID: 3644)
- sc.exe (PID: 5908)
- sc.exe (PID: 8060)
- sc.exe (PID: 4060)
- sc.exe (PID: 7704)
- sc.exe (PID: 3948)
- sc.exe (PID: 5264)
- sc.exe (PID: 1512)
- sc.exe (PID: 7892)
- sc.exe (PID: 2044)
- sc.exe (PID: 6356)
- sc.exe (PID: 7576)
- sc.exe (PID: 7188)
- sc.exe (PID: 7804)
- sc.exe (PID: 8012)
- sc.exe (PID: 2232)
- sc.exe (PID: 7904)
- sc.exe (PID: 4224)
- sc.exe (PID: 7996)
- sc.exe (PID: 4764)
- sc.exe (PID: 3748)
- sc.exe (PID: 7420)
- sc.exe (PID: 5744)
- sc.exe (PID: 7548)
- sc.exe (PID: 7944)
- sc.exe (PID: 8092)
- sc.exe (PID: 8016)
- sc.exe (PID: 7448)
- sc.exe (PID: 7540)
- sc.exe (PID: 7212)
- sc.exe (PID: 6768)
- sc.exe (PID: 7864)
- sc.exe (PID: 7912)
- sc.exe (PID: 7412)
- sc.exe (PID: 7740)
- sc.exe (PID: 7492)
- sc.exe (PID: 2116)
- sc.exe (PID: 7028)
- sc.exe (PID: 2792)
- sc.exe (PID: 5288)
- sc.exe (PID: 7916)
- sc.exe (PID: 6368)
- sc.exe (PID: 7796)
- sc.exe (PID: 7668)
- sc.exe (PID: 7720)
- sc.exe (PID: 3760)
- sc.exe (PID: 7092)
- sc.exe (PID: 2620)
- sc.exe (PID: 8056)
- sc.exe (PID: 7500)
- sc.exe (PID: 2972)
- sc.exe (PID: 7776)
- sc.exe (PID: 7752)
- sc.exe (PID: 3108)
- sc.exe (PID: 1872)
- sc.exe (PID: 3396)
- sc.exe (PID: 7384)
- sc.exe (PID: 7312)
- sc.exe (PID: 7596)
- sc.exe (PID: 5504)
- sc.exe (PID: 2356)
- sc.exe (PID: 4828)
- sc.exe (PID: 4560)
- sc.exe (PID: 3608)
- sc.exe (PID: 3968)
- sc.exe (PID: 5968)
- sc.exe (PID: 8024)
- sc.exe (PID: 4168)
- sc.exe (PID: 2716)
- sc.exe (PID: 424)
- sc.exe (PID: 3844)
- sc.exe (PID: 5532)
- sc.exe (PID: 8144)
- sc.exe (PID: 3572)
- sc.exe (PID: 7496)
- sc.exe (PID: 7232)
- sc.exe (PID: 4072)
- sc.exe (PID: 1704)
- sc.exe (PID: 6292)
- sc.exe (PID: 3160)
- sc.exe (PID: 7588)
- sc.exe (PID: 4156)
- sc.exe (PID: 3196)
- sc.exe (PID: 3000)
- sc.exe (PID: 728)
- sc.exe (PID: 7284)
- sc.exe (PID: 7676)
- sc.exe (PID: 7640)
- sc.exe (PID: 7948)
- sc.exe (PID: 1212)
- sc.exe (PID: 7336)
- sc.exe (PID: 7544)
- sc.exe (PID: 6640)
- sc.exe (PID: 7756)
- sc.exe (PID: 1388)
- sc.exe (PID: 6732)
- sc.exe (PID: 6352)
- sc.exe (PID: 8004)
- sc.exe (PID: 2168)
- sc.exe (PID: 2580)
- sc.exe (PID: 3888)
- sc.exe (PID: 7440)
- sc.exe (PID: 3736)
- sc.exe (PID: 7120)
- sc.exe (PID: 416)
- sc.exe (PID: 2128)
- sc.exe (PID: 8100)
- sc.exe (PID: 2348)
- sc.exe (PID: 7352)
- sc.exe (PID: 8088)
- sc.exe (PID: 7032)
- sc.exe (PID: 1752)
- sc.exe (PID: 5456)
- sc.exe (PID: 7532)
- sc.exe (PID: 1336)
- sc.exe (PID: 7488)
- sc.exe (PID: 7784)
- sc.exe (PID: 2072)
- sc.exe (PID: 6532)
- sc.exe (PID: 8084)
- sc.exe (PID: 7128)
- sc.exe (PID: 2216)
- sc.exe (PID: 5904)
- sc.exe (PID: 4160)
- sc.exe (PID: 3688)
- sc.exe (PID: 4444)
- sc.exe (PID: 5008)
- sc.exe (PID: 7600)
- sc.exe (PID: 7560)
- sc.exe (PID: 5432)
- sc.exe (PID: 7388)
- sc.exe (PID: 7644)
- sc.exe (PID: 7868)
- sc.exe (PID: 5348)
- sc.exe (PID: 8112)
- sc.exe (PID: 8032)
- sc.exe (PID: 2192)
- sc.exe (PID: 5020)
- sc.exe (PID: 2040)
- sc.exe (PID: 7932)
- sc.exe (PID: 8076)
- sc.exe (PID: 4052)
- sc.exe (PID: 1148)
- sc.exe (PID: 1028)
- sc.exe (PID: 7808)
- sc.exe (PID: 5172)
- sc.exe (PID: 7436)
- sc.exe (PID: 7264)
- sc.exe (PID: 4844)
- sc.exe (PID: 7332)
- sc.exe (PID: 536)
- sc.exe (PID: 7656)
- sc.exe (PID: 7516)
- sc.exe (PID: 8124)
- sc.exe (PID: 7692)
- sc.exe (PID: 5652)
- sc.exe (PID: 2368)
- sc.exe (PID: 8168)
- sc.exe (PID: 7828)
- sc.exe (PID: 3936)
- sc.exe (PID: 2272)
- sc.exe (PID: 2148)
- sc.exe (PID: 6256)
- sc.exe (PID: 2464)
- sc.exe (PID: 1560)
- sc.exe (PID: 7572)
- sc.exe (PID: 8068)
- sc.exe (PID: 5720)
- sc.exe (PID: 1568)
- sc.exe (PID: 7748)
- sc.exe (PID: 1728)
- sc.exe (PID: 7988)
- sc.exe (PID: 7316)
- sc.exe (PID: 6420)
- sc.exe (PID: 6344)
- sc.exe (PID: 4192)
- sc.exe (PID: 3564)
- sc.exe (PID: 1868)
- sc.exe (PID: 7608)
- sc.exe (PID: 7528)
- sc.exe (PID: 7760)
- sc.exe (PID: 5528)
- sc.exe (PID: 8208)
- sc.exe (PID: 7444)
- sc.exe (PID: 5988)
- sc.exe (PID: 8268)
- sc.exe (PID: 8148)
- sc.exe (PID: 3880)
- sc.exe (PID: 5780)
- sc.exe (PID: 8136)
- sc.exe (PID: 8936)
- sc.exe (PID: 9176)
- sc.exe (PID: 8196)
- sc.exe (PID: 8416)
- sc.exe (PID: 8476)
- sc.exe (PID: 8624)
- sc.exe (PID: 8688)
- sc.exe (PID: 8860)
- sc.exe (PID: 8504)
- sc.exe (PID: 8724)
- sc.exe (PID: 6836)
- sc.exe (PID: 8264)
- sc.exe (PID: 8964)
- sc.exe (PID: 9164)
- sc.exe (PID: 8228)
- sc.exe (PID: 8304)
- sc.exe (PID: 8388)
- sc.exe (PID: 8600)
- sc.exe (PID: 8448)
- sc.exe (PID: 8564)
- sc.exe (PID: 8576)
- sc.exe (PID: 3460)
- sc.exe (PID: 9060)
- sc.exe (PID: 8732)
- sc.exe (PID: 8872)
- sc.exe (PID: 5340)
- sc.exe (PID: 9204)
- sc.exe (PID: 8248)
- sc.exe (PID: 8520)
- sc.exe (PID: 8612)
- sc.exe (PID: 8644)
- sc.exe (PID: 8716)
- sc.exe (PID: 7228)
- sc.exe (PID: 8932)
- sc.exe (PID: 7344)
- sc.exe (PID: 1644)
- sc.exe (PID: 6460)
- sc.exe (PID: 7216)
- sc.exe (PID: 7552)
- sc.exe (PID: 6368)
- sc.exe (PID: 5372)
- sc.exe (PID: 7104)
- sc.exe (PID: 5708)
- sc.exe (PID: 5456)
- sc.exe (PID: 9116)
- sc.exe (PID: 7204)
- sc.exe (PID: 8312)
- sc.exe (PID: 7080)
- sc.exe (PID: 2680)
- sc.exe (PID: 8608)
- sc.exe (PID: 7828)
- sc.exe (PID: 7884)
- sc.exe (PID: 188)
- sc.exe (PID: 9000)
- sc.exe (PID: 760)
- sc.exe (PID: 7676)
- sc.exe (PID: 8020)
- sc.exe (PID: 8004)
- sc.exe (PID: 8172)
- sc.exe (PID: 4236)
- sc.exe (PID: 6392)
- sc.exe (PID: 7628)
- sc.exe (PID: 4312)
- sc.exe (PID: 7972)
Starts NET.EXE for network exploration
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
The process executes Powershell scripts
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Starts POWERSHELL.EXE for commands execution
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Stops a currently running service
- sc.exe (PID: 8864)
- sc.exe (PID: 9200)
- sc.exe (PID: 8300)
- sc.exe (PID: 8720)
- sc.exe (PID: 8440)
- sc.exe (PID: 6676)
- sc.exe (PID: 6956)
- sc.exe (PID: 8780)
- sc.exe (PID: 2124)
- sc.exe (PID: 7120)
INFO
Reads the computer name
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Checks supported languages
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Reads the machine GUID from the registry
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Create files in a temporary directory
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- svchost.exe (PID: 1508)
- update_uxIvoO.exe (PID: 4460)
- update_uxIvoO.exe (PID: 2580)
Creates files or folders in the user directory
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
Process checks computer location settings
- 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe (PID: 2404)
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Launching a file from a Registry key
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 4084)
- notepad.exe (PID: 2532)
- control.exe (PID: 3948)
- WMIC.exe (PID: 1296)
- notepad.exe (PID: 1760)
- WMIC.exe (PID: 8956)
- WMIC.exe (PID: 3608)
Manual execution by a user
- svchost.exe (PID: 1508)
- rundll32.exe (PID: 1720)
- rundll32.exe (PID: 6224)
- notepad.exe (PID: 2532)
- rundll32.exe (PID: 5952)
- rundll32.exe (PID: 1740)
- control.exe (PID: 3948)
- rundll32.exe (PID: 1356)
- update_uxIvoO.exe (PID: 2580)
- notepad.exe (PID: 1760)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 9016)
Uses Task Scheduler to autorun other applications (AUTOMATE)
- update_uxIvoO.exe (PID: 4460)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 8908)
- powershell.exe (PID: 8200)
- powershell.exe (PID: 8740)
- powershell.exe (PID: 9016)
Launching a file from Task Scheduler
- svchost.exe (PID: 724)
- update_uxIvoO.exe (PID: 4460)
Checks proxy server information
- slui.exe (PID: 7296)
Reads the software policy settings
- slui.exe (PID: 7296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:06:19 23:24:36+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 74240 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x141be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 0.0.0.0 |
| InternalName: | LB3.exe |
| LegalCopyright: | |
| OriginalFileName: | LB3.exe |
| ProductVersion: | 0.0.0.0 |
| AssemblyVersion: | 0.0.0.0 |
Total processes
2 276
Monitored processes
2 142
Malicious processes
8
Suspicious processes
6
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "net.exe" stop vss | C:\Windows\System32\net.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 188 | C:\WINDOWS\system32\net1 stop mysql | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 188 | "sc.exe" config BackupExecDiveciMediaService start=disabled | C:\Windows\System32\sc.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Service Control Manager Configuration Tool Exit code: 1060 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 188 | "sc.exe" delete VSNAPVSS | C:\Windows\System32\sc.exe | — | update_uxIvoO.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Service Control Manager Configuration Tool Exit code: 1060 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 236 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 416 | "cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\selfdestruct_mTcOl2oN.bat" | C:\Windows\System32\cmd.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 416 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | wbadmin.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 416 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | sc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 416 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | wbadmin.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 416 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | sc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
49 463
Read events
49 451
Write events
12
Delete events
0
Modification events
| (PID) Process: | (724) svchost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |
| Operation: | write | Name: | UpdateEyKLTV |
Value: C:\Users\admin\AppData\Local\svchost.exe | |||
| (PID) Process: | (724) svchost.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command |
| Operation: | write | Name: | DelegateExecute |
Value: | |||
| (PID) Process: | (3948) control.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (3948) control.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3948) control.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3948) control.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4460) update_uxIvoO.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |
| Operation: | write | Name: | Update7vLJi9 |
Value: C:\Users\admin\AppData\Local\Temp\update_uxIvoO.exe | |||
| (PID) Process: | (4460) update_uxIvoO.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command |
| Operation: | write | Name: | DelegateExecute |
Value: | |||
| (PID) Process: | (724) svchost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | XRgvmmR6D |
Value: C:\Users\admin\AppData\Local\svchost.exe | |||
| (PID) Process: | (4460) update_uxIvoO.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | M8hMXXw0T |
Value: C:\Users\admin\AppData\Local\Temp\update_uxIvoO.exe | |||
Executable files
11
Suspicious files
85
Text files
55
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 724 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_G6S7pwGW.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 724 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_IYzTJ2gW.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 2404 | 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_HYX3B86k.bat | text | |
MD5:01F4EEB56F1ED9EE291C11AD5BE1D8FB | SHA256:23EC95F140703E35674FAE6AAA939A537D70873B6FD7D5D77F98E85CE192F9ED | |||
| 1508 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_d1iCdMfk.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 724 | svchost.exe | C:\Users\admin\AppData\Local\Temp\update_zHOSCx.exe | executable | |
MD5:34828F7BDA1392A648369CFE76E10CBA | SHA256:059A442C795180D2B0303D07C416CEBC68632EA84A2DAEC04ED396E7CF63CF92 | |||
| 2404 | 2025-06-21_34828f7bda1392a648369cfe76e10cba_destroyer_elex_wannacry.exe | C:\Users\admin\AppData\Local\svchost.exe | executable | |
MD5:34828F7BDA1392A648369CFE76E10CBA | SHA256:059A442C795180D2B0303D07C416CEBC68632EA84A2DAEC04ED396E7CF63CF92 | |||
| 724 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_mTcOl2oN.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 1508 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_g701J9Vm.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 1508 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_X3er9FNC.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
| 724 | svchost.exe | C:\Users\admin\AppData\Local\Temp\selfdestruct_NAvx7fme.bat | text | |
MD5:80384AC2A6120ACBE512303AEBC66A1D | SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
41
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | GET | 200 | 184.25.50.8:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 184.25.50.8:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5232 | RUXIMICS.exe | GET | 200 | 184.25.50.8:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 20.190.159.4:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | POST | 200 | 20.190.159.4:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 16.7 Kb | whitelisted |
— | — | POST | 200 | 40.126.31.130:443 | https://login.live.com/RST2.srf | unknown | xml | 11.1 Kb | whitelisted |
— | — | POST | 200 | 40.126.31.1:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | whitelisted |
— | — | POST | 200 | 40.126.31.3:443 | https://login.live.com/RST2.srf | unknown | xml | 11.0 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5232 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 184.25.50.8:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 184.25.50.8:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5232 | RUXIMICS.exe | 184.25.50.8:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
Process | Message |
|---|---|
wbadmin.exe | Invalid parameter passed to C runtime function.
|
wbadmin.exe | Invalid parameter passed to C runtime function.
|
wbadmin.exe | Invalid parameter passed to C runtime function.
|
wbadmin.exe | Invalid parameter passed to C runtime function.
|
wbadmin.exe | Invalid parameter passed to C runtime function.
|
wbadmin.exe | Invalid parameter passed to C runtime function.
|