URL:

https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r.zip

Full analysis: https://app.any.run/tasks/190a10ea-eb34-4efb-af80-adf3b494b29a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 05, 2024, 18:00:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
wannacry
ransomware
wannacryptor
Indicators:
MD5:

9A79D6AC204F75853653BAA120B40F08

SHA1:

F839F1C47599E8DFB6F71DFCA1EFB1F04B07F08C

SHA256:

7D23372F4012D9EC494FEA47D0F92462F9BF7BED7FAF8FF1942DE6DBB3333702

SSDEEP:

3:N8tEdegLaKoEJ3PqLKGEie+myEXkz7U:2ufLtf3GEizmXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Wannacry exe files

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2112)
      • @WanaDecryptor@.exe (PID: 2896)
      • cmd.exe (PID: 2748)
      • @WanaDecryptor@.exe (PID: 1192)
      • @WanaDecryptor@.exe (PID: 2856)

    • Writes a file to the Word startup folder

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Modifies files in the Chrome extension folder

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Actions looks like stealing of personal data

      • @WanaDecryptor@.exe (PID: 2732)
      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • WannaCry Ransomware is detected

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • cmd.exe (PID: 2748)

  • SUSPICIOUS

    • Uses ATTRIB.EXE to modify file attributes

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Uses ICACLS.EXE to modify access control lists

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • The process executes VB scripts

      • cmd.exe (PID: 2300)

    • Executing commands from a ".bat" file

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Starts CMD.EXE for commands execution

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Creates files like ransomware instruction

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1220)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1620)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1620)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 2184)
      • WinRAR.exe (PID: 1216)

    • Application launched itself

      • iexplore.exe (PID: 2184)

    • Create files in a temporary directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • cscript.exe (PID: 1560)
      • @WanaDecryptor@.exe (PID: 2732)

    • Checks supported languages

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskdl.exe (PID: 2344)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskdl.exe (PID: 2292)
      • @WanaDecryptor@.exe (PID: 2896)
      • taskhsvc.exe (PID: 2176)
      • @WanaDecryptor@.exe (PID: 2112)
      • taskdl.exe (PID: 2540)
      • @WanaDecryptor@.exe (PID: 1192)
      • taskdl.exe (PID: 2368)
      • @WanaDecryptor@.exe (PID: 2856)
      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)
      • wmpnscfg.exe (PID: 2296)
      • wmpnscfg.exe (PID: 2316)

    • Dropped object may contain TOR URL's

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)

    • Drops the executable file immediately after the start

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)
      • WinRAR.exe (PID: 1216)

    • Reads the computer name

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskhsvc.exe (PID: 2176)
      • IMEKLMG.EXE (PID: 888)
      • wmpnscfg.exe (PID: 2316)
      • IMEKLMG.EXE (PID: 404)
      • wmpnscfg.exe (PID: 2296)

    • The dropped object may contain a URL to Tor Browser

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)

    • Process drops legitimate windows executable

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • WinRAR.exe (PID: 1216)

    • Reads the machine GUID from the registry

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskhsvc.exe (PID: 2176)

    • Creates files or folders in the user directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)
      • taskhsvc.exe (PID: 2176)
      • sipnotify.exe (PID: 1620)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 1560)
      • sipnotify.exe (PID: 1620)

    • Manual execution by a user

      • WINWORD.EXE (PID: 376)
      • @WanaDecryptor@.exe (PID: 2732)
      • taskmgr.exe (PID: 2840)
      • wmpnscfg.exe (PID: 2296)
      • wmpnscfg.exe (PID: 2316)
      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)

    • Wannacry exe files

      • @WanaDecryptor@.exe (PID: 2732)

    • Creates files in the program directory

      • Endermanch@WannaCrypt0r.exe (PID: 1824)

    • The executable file from the user directory is run by the CMD process

      • @WanaDecryptor@.exe (PID: 2896)

    • Connects to unusual port

      • taskhsvc.exe (PID: 2176)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1532)
      • sipnotify.exe (PID: 1620)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 404)
      • IMEKLMG.EXE (PID: 888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
29
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs #WANNACRY endermanch@wannacrypt0r.exe attrib.exe no specs icacls.exe no specs taskdl.exe no specs cmd.exe no specs cscript.exe no specs winword.exe no specs #WANNACRY @wanadecryptor@.exe taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs #WANNACRY cmd.exe no specs #WANNACRY @wanadecryptor@.exe no specs taskhsvc.exe taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs cmd.exe no specs reg.exe no specs taskdl.exe no specs #WANNACRY @wanadecryptor@.exe no specs taskmgr.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\hardwarehappy.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
404"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
864"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2184 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
888"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1192@WanaDecryptor@.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1216.11013\@WanaDecryptor@.exe
Endermanch@WannaCrypt0r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Load PerfMon Counters
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1216.11013\@wanadecryptor@.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WannaCrypt0r.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1220cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yyibsxxiapw107" /t REG_SZ /d "\"C:\Users\admin\AppData\Local\Temp\Rar$EXb1216.11013\tasksche.exe\"" /fC:\Windows\System32\cmd.exe—Endermanch@WannaCrypt0r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1532C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1560cscript.exe //nologo m.vbsC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1620C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
25 385
Read events
25 115
Write events
124
Delete events
146

Modification events

(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2184) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
20
Suspicious files
1 100
Text files
490
Unknown types
0

Dropped files

PID
Process
Filename
Type
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:5EBA6C85EF24971CBC378D22F190E0AC
SHA256:CC68D4156641E5B29F3319EA503E322FDEE6BAD7AC3C1AA63434EC69C67D6DD2
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:9C2227C8F60BEC6F5D510E8E3E6EF82A
SHA256:B7364E4D3AB18B3FB3BD079273B6A626E2182C0CAC10DC64422126DA9F61D3CF
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:52D6F1705242B6C6966882AF557080A1
SHA256:D7AB274D8A406FE1E27C9F0A9B1CA12C5C1C4586ADFD664EF7140FBA87FC6BB1
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:897A542B8F486055AD407063D69635ED
SHA256:1D2E221AAC02F0FB96D2FFF04D80A4FE77DF301A574B9F5DAB68074376727297
2184iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WannaCrypt0r.zip.yofcgvy.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\WannaCrypt0r[1].zipcompressed
MD5:D2F45EBDC72DF5026F758A16B9B87F2E
SHA256:094767AB18B8646D6D2AA4F0317E5F6E293D79F0425879E67E64E6265180266D
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:A51FFFB4B2D2D54242B0C1332311509C
SHA256:6BA3252C45DEFD902222410F9B5EA5138BE0C9F8C5DE502F193F093EF16C354D
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:C7C0C0709F4A138B785BFD0649DFAC6E
SHA256:323A6947E7B01C3ACC951E5EBB7BC1E6376A3C566365F336394F48DA30469BB7
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:614695759D1F000E9DD28BB0B1BD8D23
SHA256:E33DF4329FABCD0DDAF30E020D8FC7DBC5194E0BD49A87AF66FED2F5EDE89332
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
12
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53bfb7cf8a6cf97e
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAzQqL7GMs%2FmReygqbCE%2Bxw%3D
unknown
binary
312 b
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?914f352674d8023c
unknown
—
—
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22dec979149153ff
unknown
—
—
unknown
2184
iexplore.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?68632eabf0995fd9
unknown
—
—
unknown
864
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
unknown
1080
svchost.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e90c163b6659448e
unknown
—
—
unknown
2184
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
864
iexplore.exe
140.82.121.3:443
github.com
GITHUB
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
864
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
864
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
864
iexplore.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2184
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
2184
iexplore.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2184
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
query.prod.cms.rt.microsoft.com
  • 23.199.215.176
whitelisted

Threats

PID
Process
Class
Message
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 161
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 167
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 240
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Exit Node Traffic group 30
2176
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 31
2176
taskhsvc.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
2176
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r.zip