URL:

https://originaldll.com/file/wannacry.exe/41397.html

Full analysis: https://app.any.run/tasks/5b57477c-9344-4aa9-9f4d-5c91adf6435c
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 16:34:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
wannacry
wannacryptor
Indicators:
MD5:

CC3E4E15A28EB1D5CF03F3E3E4DA201D

SHA1:

A30A4D8801780909A4A8B7CC94ABCB0E469110ED

SHA256:

C65468CC808599E522C0CBB77C72D4D99B18309AE8E22789992A79259DE91667

SSDEEP:

3:N8eQLEPZzoXK4Jb8:2eQLB5JI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • wannacry.exe (PID: 2044)

    • Application was dropped or rewritten from another process

      • wannacry.exe (PID: 2044)
      • taskdl.exe (PID: 3024)
      • @WanaDecryptor@.exe (PID: 2064)
      • @WanaDecryptor@.exe (PID: 3316)
      • taskhsvc.exe (PID: 3232)
      • taskdl.exe (PID: 2620)
      • @WanaDecryptor@.exe (PID: 1036)
      • taskdl.exe (PID: 2356)
      • @WanaDecryptor@.exe (PID: 2416)

    • Actions looks like stealing of personal data

      • wannacry.exe (PID: 2044)

    • Writes file to Word startup folder

      • wannacry.exe (PID: 2044)

    • Modifies files in Chrome extension folder

      • wannacry.exe (PID: 2044)

    • WannaCry Ransomware was detected

      • cmd.exe (PID: 2412)
      • wannacry.exe (PID: 2044)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3536)
      • taskhsvc.exe (PID: 3232)

    • Deletes shadow copies

      • cmd.exe (PID: 4072)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 4072)

    • Loads the Task Scheduler COM API

      • wbengine.exe (PID: 2580)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2240)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • wannacry.exe (PID: 2044)
      • @WanaDecryptor@.exe (PID: 3316)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2696)
      • wannacry.exe (PID: 2044)
      • @WanaDecryptor@.exe (PID: 2064)

    • Creates files like Ransomware instruction

      • wannacry.exe (PID: 2044)

    • Drops a file with too old compile date

      • wannacry.exe (PID: 2044)
      • @WanaDecryptor@.exe (PID: 2064)

    • Uses ICACLS.EXE to modify access control list

      • wannacry.exe (PID: 2044)

    • Executes scripts

      • cmd.exe (PID: 2432)

    • Uses ATTRIB.EXE to modify file attributes

      • wannacry.exe (PID: 2044)

    • Creates files in the program directory

      • wannacry.exe (PID: 2044)

    • Creates files in the user directory

      • wannacry.exe (PID: 2044)
      • taskhsvc.exe (PID: 3232)

    • Drops a file that was compiled in debug mode

      • @WanaDecryptor@.exe (PID: 2064)

    • Executed as Windows Service

      • vssvc.exe (PID: 2856)
      • wbengine.exe (PID: 2580)
      • vds.exe (PID: 3220)

    • Low-level read access rights to disk partition

      • wbengine.exe (PID: 2580)
      • vds.exe (PID: 3220)

    • Executed via COM

      • vdsldr.exe (PID: 3196)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2168)

    • Creates files in the Windows directory

      • wbadmin.exe (PID: 2772)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2696)

    • Dropped object may contain Bitcoin addresses

      • wannacry.exe (PID: 2044)
      • taskhsvc.exe (PID: 3232)

    • Dropped object may contain TOR URL's

      • wannacry.exe (PID: 2044)

    • Creates files in the program directory

      • firefox.exe (PID: 2696)

    • Application launched itself

      • firefox.exe (PID: 1808)
      • firefox.exe (PID: 2696)

    • Dropped object may contain URL to Tor Browser

      • wannacry.exe (PID: 2044)

    • Changes settings of System certificates

      • pingsender.exe (PID: 3184)
      • pingsender.exe (PID: 696)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 3184)
      • pingsender.exe (PID: 696)

    • Creates files in the user directory

      • firefox.exe (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
35
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe #WANNACRY wannacry.exe attrib.exe no specs icacls.exe no specs taskdl.exe no specs cmd.exe no specs cscript.exe no specs @wanadecryptor@.exe #WANNACRY cmd.exe no specs @wanadecryptor@.exe no specs taskhsvc.exe searchprotocolhost.exe no specs pingsender.exe pingsender.exe cmd.exe vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs taskdl.exe no specs @wanadecryptor@.exe no specs cmd.exe no specs reg.exe taskdl.exe no specs @wanadecryptor@.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/9dc25c8a-91cc-4e1d-936e-21a83205af28/event/Firefox/68.0.1/release/20190717172542?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\9dc25c8a-91cc-4e1d-936e-21a83205af28C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1036@WanaDecryptor@.exeC:\Users\admin\Downloads\@WanaDecryptor@.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Load PerfMon Counters
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\downloads\@wanadecryptor@.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1144cscript.exe //nologo m.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1236attrib +h .C:\Windows\system32\attrib.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1452bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\system32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1808"C:\Program Files\Mozilla Firefox\firefox.exe" "https://originaldll.com/file/wannacry.exe/41397.html"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2044"C:\Users\admin\Downloads\wannacry.exe" C:\Users\admin\Downloads\wannacry.exe
firefox.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DiskPart
Exit code:
1073807364
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\downloads\wannacry.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
2064@WanaDecryptor@.exe coC:\Users\admin\Downloads\@WanaDecryptor@.exe
wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Load PerfMon Counters
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\downloads\@wanadecryptor@.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
2080icacls . /grant Everyone:F /T /C /QC:\Windows\system32\icacls.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
2168cmd.exe /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yyibsxxiapw107" /t REG_SZ /d "\"C:\Users\admin\Downloads\tasksche.exe\"" /fC:\Windows\system32\cmd.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 936
Read events
1 868
Write events
66
Delete events
2

Modification events

(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
C3D6B61A01000000
(PID) Process:(1808) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
DFECB01A01000000
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2044) wannacry.exeKey:HKEY_CURRENT_USER\Software\WanaCrypt0r
Operation:writeName:wd
Value:
C:\Users\admin\Downloads
(PID) Process:(3536) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3536) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
20
Suspicious files
746
Text files
526
Unknown types
169

Dropped files

PID
Process
Filename
Type
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\05CC6EC8F2349AC9AA87BF5DFFD9C2443863F8B7der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
111
DNS requests
184
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
92.122.214.144:80
http://ocsp.int-x3.letsencrypt.org/
unknown
der
527 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2696
firefox.exe
176.9.61.4:443
originaldll.com
Hetzner Online GmbH
DE
suspicious
2696
firefox.exe
92.122.214.144:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
unknown
2696
firefox.exe
52.26.177.54:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
2696
firefox.exe
88.212.201.210:443
counter.yadro.ru
United Network LLC
RU
suspicious
2696
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2696
firefox.exe
65.9.68.82:443
snippets.cdn.mozilla.net
AT&T Services, Inc.
US
unknown
2696
firefox.exe
172.217.18.98:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted
2696
firefox.exe
172.217.22.34:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
2696
firefox.exe
172.217.18.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2696
firefox.exe
65.9.68.6:443
firefox.settings.services.mozilla.com
AT&T Services, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
whitelisted
search.services.mozilla.com
  • 52.41.230.109
  • 44.238.74.153
  • 34.218.9.172
whitelisted
search.r53-2.services.mozilla.com
  • 34.218.9.172
  • 44.238.74.153
  • 52.41.230.109
whitelisted
originaldll.com
  • 176.9.61.4
whitelisted
push.services.mozilla.com
  • 52.26.177.54
whitelisted
autopush.prod.mozaws.net
  • 52.26.177.54
whitelisted
snippets.cdn.mozilla.net
  • 65.9.68.82
  • 65.9.68.94
  • 65.9.68.124
  • 65.9.68.17
whitelisted
d228z91au11ukj.cloudfront.net
  • 65.9.68.17
  • 65.9.68.124
  • 65.9.68.94
  • 65.9.68.82
whitelisted
ocsp.int-x3.letsencrypt.org
  • 92.122.214.144
  • 92.122.214.152
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3232
taskhsvc.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 828
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 663
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 293
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://originaldll.com/file/wannacry.exe/41397.html