File name:

wannacry_2.0

Full analysis: https://app.any.run/tasks/3217c44e-0e9f-4300-8e78-88f0f8cb206d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 20, 2023, 16:20:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
wannacry
wannacryptor
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4DA1F312A214C07143ABEEAFB695D904

SHA1:

B629F072C9241FD2451F1CBCA2290197E72A8F5E

SHA256:

AEE20F9188A5C3954623583C6B0E6623EC90D5CD3FDEC4E1001646E27664002C

SSDEEP:

98304:j9NL/27jD7UR9RNoBy/S9y8X7QcVzBMAZtQcuIDFQalV6ghPwjoSlXcinEW+186+:eNr3XlVUUPg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 3420)

    • WannaCry Ransomware is detected

      • wannacry_2.0.exe (PID: 3220)
      • cmd.exe (PID: 1436)

    • Writes a file to the Word startup folder

      • wannacry_2.0.exe (PID: 3220)

    • Modifies files in the Chrome extension folder

      • wannacry_2.0.exe (PID: 3220)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2028)

    • Deletes shadow copies

      • cmd.exe (PID: 2028)

    • Actions looks like stealing of personal data

      • wannacry_2.0.exe (PID: 3220)

  • SUSPICIOUS

    • The process executes VB scripts

      • cmd.exe (PID: 3540)

    • Starts CMD.EXE for commands execution

      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 2376)

    • Uses TASKKILL.EXE to kill process

      • wannacry_2.0.exe (PID: 3220)

    • Executing commands from a ".bat" file

      • wannacry_2.0.exe (PID: 3220)

    • Creates files like ransomware instruction

      • wannacry_2.0.exe (PID: 3220)

    • Connects to unusual port

      • taskhosts.exe (PID: 3968)

    • Reads the Internet Settings

      • !WannaDecryptor!.exe (PID: 2376)
      • WMIC.exe (PID: 2740)

    • Executes as Windows Service

      • VSSVC.exe (PID: 284)
      • wbengine.exe (PID: 1420)
      • vds.exe (PID: 680)

  • INFO

    • The dropped object may contain a URL to Tor Browser

      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 3420)

    • Checks supported languages

      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 3420)
      • taskhosts.exe (PID: 3968)
      • wmpnscfg.exe (PID: 3536)
      • !WannaDecryptor!.exe (PID: 2376)
      • !WannaDecryptor!.exe (PID: 2196)
      • !WannaDecryptor!.exe (PID: 1608)

    • Dropped object may contain TOR URL's

      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 3420)

    • Reads the computer name

      • wannacry_2.0.exe (PID: 3220)
      • taskhosts.exe (PID: 3968)
      • wmpnscfg.exe (PID: 3536)
      • !WannaDecryptor!.exe (PID: 2376)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2900)

    • Create files in a temporary directory

      • cscript.exe (PID: 2900)
      • wannacry_2.0.exe (PID: 3220)
      • !WannaDecryptor!.exe (PID: 3420)

    • Reads the machine GUID from the registry

      • wannacry_2.0.exe (PID: 3220)
      • taskhosts.exe (PID: 3968)
      • wmpnscfg.exe (PID: 3536)

    • Creates files or folders in the user directory

      • wannacry_2.0.exe (PID: 3220)
      • taskhosts.exe (PID: 3968)

    • Creates files in the program directory

      • wannacry_2.0.exe (PID: 3220)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3536)

    • The executable file from the user directory is run by the CMD process

      • !WannaDecryptor!.exe (PID: 2376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:04:08 23:36:48+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28672
InitializedDataSize: 4464640
UninitializedDataSize: -
EntryPoint: 0x6f9a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
24
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #WANNACRY wannacry_2.0.exe cmd.exe no specs cscript.exe no specs !wannadecryptor!.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskhosts.exe wmpnscfg.exe no specs !wannadecryptor!.exe no specs #WANNACRY cmd.exe no specs !wannadecryptor!.exe no specs !wannadecryptor!.exe no specs cmd.exe vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
292C:\Windows\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
680C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
988wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1420"C:\Windows\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1436cmd.exe /c start /b !WannaDecryptor!.exe vC:\Windows\System32\cmd.exe
wannacry_2.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1584bcdedit /set {default} recoveryenabled no C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1608!WannaDecryptor!.exeC:\Users\admin\AppData\Local\Temp\!WannaDecryptor!.exe—wannacry_2.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Message MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\!wannadecryptor!.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2000vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2028"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\System32\cmd.exe
!WannaDecryptor!.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 451
Read events
2 439
Write events
9
Delete events
3

Modification events

(PID) Process:(3536) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{6F8DE70C-4C40-483A-B092-527384E9F322}\{5E41641D-BA92-4DAC-96F2-54F1670462F9}
Operation:delete keyName:(default)
Value:
(PID) Process:(3536) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{6F8DE70C-4C40-483A-B092-527384E9F322}
Operation:delete keyName:(default)
Value:
(PID) Process:(3536) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{75020FD3-0945-40B8-A8D5-AAF0C94CC32E}
Operation:delete keyName:(default)
Value:
(PID) Process:(2376) !WannaDecryptor!.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2376) !WannaDecryptor!.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2376) !WannaDecryptor!.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2376) !WannaDecryptor!.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1584) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{345b46fd-a9f9-11e7-a83c-e8a4f72b1d33}\Elements\16000009
Operation:writeName:Element
Value:
01
Executable files
12
Suspicious files
1 218
Text files
644
Unknown types
0

Dropped files

PID
Process
Filename
Type
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\c.wrybinary
MD5:725BF255D114B71AACB9E610BB92027A
SHA256:BA18EE229C1C9D9AD12979FEBFBB6A258780BCBC4CC907DEE4141E0382E23DC9
3540cmd.exeC:\Users\admin\AppData\Local\Temp\c.vbstext
MD5:2C69421394B3CF1E8531E5BA60824C2F
SHA256:89CDEBC8A19455D87815A80CEE66AE366C3391D6A776F21753248CF2DC857554
3220wannacry_2.0.exeC:\Users\admin\Desktop\aniii.rtf.WCRYbinary
MD5:94A0143CEB3676CF2230861EE783F940
SHA256:5B14802662ACDF1C77C1E44C91BB6B15DE48F1655A4E4891CD6FA1C5E2807147
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\r.wrytext
MD5:880E6A619106B3DEF7E1255F67CB8099
SHA256:C9E9DC06F500AE39BFEB4671233CC97BB6DAB58D97BB94ABA4A2E0E509418D35
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\t.wrybinary
MD5:48099908E66D81901EB2076702AFD73C
SHA256:ACBDA91076017D4DDEA25B136C1F94A28AFCD66418DEBD82804053DF60ACF94F
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\m.wrytext
MD5:54C0E4AA798CE82886A96BA4BB449188
SHA256:E5373E95A201B3B676072752097FF5D851A0A34E1BE4194FF0C52C33601E576A
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\!Please Read Me!.txttext
MD5:2E96A6F11864FD42C3BF67B3A4C5B170
SHA256:354999CC1BE1F92EE99AE457B7A7A563CF45A98CABA81B3816AB3D2743ABFC5C
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\!WannaDecryptor!.exeexecutable
MD5:B27F095F305CF940BA4E85F3CB848819
SHA256:57C12D8573D2F3883A8A0BA14E3EEC02AC1C61DEE6B675B6C0D16E221C3777F4
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\s.wrycompressed
MD5:7CF776F898D58F8BE1C44F254FC00643
SHA256:053FF873D80F419C5CF1A01A32B67A2584C74AFD351B79D358AB0D7AC42858F8
3220wannacry_2.0.exeC:\Users\admin\AppData\Local\Temp\u.wryexecutable
MD5:B27F095F305CF940BA4E85F3CB848819
SHA256:57C12D8573D2F3883A8A0BA14E3EEC02AC1C61DEE6B675B6C0D16E221C3777F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
13
DNS requests
0
Threats
6

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3968
taskhosts.exe
128.199.55.207:9001
—
DIGITALOCEAN-ASN
NL
unknown
3968
taskhosts.exe
154.35.175.225:443
—
RETHEMHOSTING
US
malicious
3968
taskhosts.exe
212.83.154.33:8443
—
Online S.a.s.
FR
unknown
3968
taskhosts.exe
78.142.142.246:443
—
Hutchison Drei Austria GmbH
AT
unknown
3968
taskhosts.exe
185.66.250.141:9001
—
CLDIN B.V.
NL
unknown
3968
taskhosts.exe
199.254.238.52:443
—
RISEUP
US
unknown

DNS requests

No data

Threats

PID
Process
Class
Message
3968
taskhosts.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
3968
taskhosts.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 767
3968
taskhosts.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
3968
taskhosts.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 780
3968
taskhosts.exe
Unknown Traffic
ET JA3 Hash - Possible Malware - Malspam
3968
taskhosts.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wannacry_2.0