URL:

https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r.zip

Full analysis: https://app.any.run/tasks/190a10ea-eb34-4efb-af80-adf3b494b29a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 05, 2024, 18:00:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
wannacry
ransomware
wannacryptor
Indicators:
MD5:

9A79D6AC204F75853653BAA120B40F08

SHA1:

F839F1C47599E8DFB6F71DFCA1EFB1F04B07F08C

SHA256:

7D23372F4012D9EC494FEA47D0F92462F9BF7BED7FAF8FF1942DE6DBB3333702

SSDEEP:

3:N8tEdegLaKoEJ3PqLKGEie+myEXkz7U:2ufLtf3GEizmXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Wannacry exe files

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2112)
      • cmd.exe (PID: 2748)
      • @WanaDecryptor@.exe (PID: 2896)
      • @WanaDecryptor@.exe (PID: 1192)
      • @WanaDecryptor@.exe (PID: 2856)

    • Writes a file to the Word startup folder

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Actions looks like stealing of personal data

      • @WanaDecryptor@.exe (PID: 2732)
      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • WannaCry Ransomware is detected

      • cmd.exe (PID: 2748)
      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Modifies files in the Chrome extension folder

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

  • SUSPICIOUS

    • Uses ATTRIB.EXE to modify file attributes

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Uses ICACLS.EXE to modify access control lists

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Creates files like ransomware instruction

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Executing commands from a ".bat" file

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • The process executes VB scripts

      • cmd.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1220)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1620)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1620)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1216)
      • iexplore.exe (PID: 2184)

    • Application launched itself

      • iexplore.exe (PID: 2184)

    • Checks supported languages

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskdl.exe (PID: 2344)
      • @WanaDecryptor@.exe (PID: 2112)
      • @WanaDecryptor@.exe (PID: 2896)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskdl.exe (PID: 2292)
      • taskhsvc.exe (PID: 2176)
      • taskdl.exe (PID: 2540)
      • @WanaDecryptor@.exe (PID: 1192)
      • taskdl.exe (PID: 2368)
      • @WanaDecryptor@.exe (PID: 2856)
      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)
      • wmpnscfg.exe (PID: 2296)
      • wmpnscfg.exe (PID: 2316)

    • Reads the computer name

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskhsvc.exe (PID: 2176)
      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)
      • wmpnscfg.exe (PID: 2316)
      • wmpnscfg.exe (PID: 2296)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1216)
      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1216)
      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)

    • The dropped object may contain a URL to Tor Browser

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)

    • Create files in a temporary directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • cscript.exe (PID: 1560)
      • @WanaDecryptor@.exe (PID: 2732)

    • Creates files or folders in the user directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskhsvc.exe (PID: 2176)
      • sipnotify.exe (PID: 1620)

    • Creates files in the program directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Dropped object may contain TOR URL's

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)

    • Reads the machine GUID from the registry

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskhsvc.exe (PID: 2176)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 1560)
      • sipnotify.exe (PID: 1620)

    • Manual execution by a user

      • WINWORD.EXE (PID: 376)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskmgr.exe (PID: 2840)
      • IMEKLMG.EXE (PID: 888)
      • wmpnscfg.exe (PID: 2316)
      • IMEKLMG.EXE (PID: 404)
      • wmpnscfg.exe (PID: 2296)

    • Wannacry exe files

      • @WanaDecryptor@.exe (PID: 2732)

    • The executable file from the user directory is run by the CMD process

      • @WanaDecryptor@.exe (PID: 2896)

    • Connects to unusual port

      • taskhsvc.exe (PID: 2176)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1620)
      • ctfmon.exe (PID: 1532)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
29
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs #WANNACRY endermanch@wannacrypt0r.exe attrib.exe no specs icacls.exe no specs taskdl.exe no specs cmd.exe no specs cscript.exe no specs winword.exe no specs #WANNACRY @wanadecryptor@.exe taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs #WANNACRY cmd.exe no specs #WANNACRY @wanadecryptor@.exe no specs taskhsvc.exe taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs cmd.exe no specs reg.exe no specs taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs taskmgr.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\hardwarehappy.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
404"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
864"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2184 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
888"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1192@WanaDecryptor@.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1216.11013\@WanaDecryptor@.exe
Endermanch@WannaCrypt0r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Load PerfMon Counters
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1216.11013\@wanadecryptor@.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WannaCrypt0r.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1220cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yyibsxxiapw107" /t REG_SZ /d "\"C:\Users\admin\AppData\Local\Temp\Rar$EXb1216.11013\tasksche.exe\"" /fC:\Windows\System32\cmd.exe—Endermanch@WannaCrypt0r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1532C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1560cscript.exe //nologo m.vbsC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1620C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
25 385
Read events
25 115
Write events
124
Delete events
146

Modification events

(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
20
Suspicious files
1 100
Text files
490
Unknown types
0

Dropped files

PID
Process
Filename
Type
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:A51FFFB4B2D2D54242B0C1332311509C
SHA256:6BA3252C45DEFD902222410F9B5EA5138BE0C9F8C5DE502F193F093EF16C354D
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:614695759D1F000E9DD28BB0B1BD8D23
SHA256:E33DF4329FABCD0DDAF30E020D8FC7DBC5194E0BD49A87AF66FED2F5EDE89332
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2184iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{48643725-ABF4-11EE-AE0A-12A9866C77DE}.datbinary
MD5:C7C8430FD2B9AADD914F28DB8BBDAFFB
SHA256:FADC56D722C3375084D511C45135EF0BA2316B6A57342C390916FBBF41575F71
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:34D5778526A8892DBB48F55F5C14A96A
SHA256:6A5410BB073FB2C87C1C6BA8A417762734F1E5BC44A801950ED1E5AA58786B35
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:52D6F1705242B6C6966882AF557080A1
SHA256:D7AB274D8A406FE1E27C9F0A9B1CA12C5C1C4586ADFD664EF7140FBA87FC6BB1
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:9C2227C8F60BEC6F5D510E8E3E6EF82A
SHA256:B7364E4D3AB18B3FB3BD079273B6A626E2182C0CAC10DC64422126DA9F61D3CF
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\WannaCrypt0r[1].zipcompressed
MD5:D2F45EBDC72DF5026F758A16B9B87F2E
SHA256:094767AB18B8646D6D2AA4F0317E5F6E293D79F0425879E67E64E6265180266D
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:897A542B8F486055AD407063D69635ED
SHA256:1D2E221AAC02F0FB96D2FFF04D80A4FE77DF301A574B9F5DAB68074376727297
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WannaCrypt0r.zip.yofcgvy.partialcompressed
MD5:E58FDD8B0CE47BCB8FFD89F4499D186D
SHA256:283F40E9D550833BEC101A24FD6FD6FBD9937ED32A51392E818FFFF662A1D30A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
12
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53bfb7cf8a6cf97e
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAzQqL7GMs%2FmReygqbCE%2Bxw%3D
unknown
binary
312 b
unknown
864
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?914f352674d8023c
unknown
—
—
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22dec979149153ff
unknown
—
—
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?68632eabf0995fd9
unknown
—
—
unknown
2184
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e90c163b6659448e
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
864
iexplore.exe
140.82.121.3:443
github.com
GITHUB
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
864
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
864
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
864
iexplore.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2184
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
2184
iexplore.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2184
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
query.prod.cms.rt.microsoft.com
  • 23.199.215.176
whitelisted

Threats

PID
Process
Class
Message
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 161
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 167
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 240
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Exit Node Traffic group 30
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 31
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r.zip