analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://originaldll.com/file/wannacry.exe/41397.html

Full analysis: https://app.any.run/tasks/5b57477c-9344-4aa9-9f4d-5c91adf6435c
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 16:34:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
wannacry
wannacryptor
Indicators:
MD5:

CC3E4E15A28EB1D5CF03F3E3E4DA201D

SHA1:

A30A4D8801780909A4A8B7CC94ABCB0E469110ED

SHA256:

C65468CC808599E522C0CBB77C72D4D99B18309AE8E22789992A79259DE91667

SSDEEP:

3:N8eQLEPZzoXK4Jb8:2eQLB5JI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

    • Drops executable file immediately after starts

      • wannacry.exe (PID: 2044)

    • Writes file to Word startup folder

      • wannacry.exe (PID: 2044)

    • Actions looks like stealing of personal data

      • wannacry.exe (PID: 2044)

    • WannaCry Ransomware was detected

      • cmd.exe (PID: 2412)
      • wannacry.exe (PID: 2044)

    • Modifies files in Chrome extension folder

      • wannacry.exe (PID: 2044)

    • Loads dropped or rewritten executable

      • taskhsvc.exe (PID: 3232)
      • SearchProtocolHost.exe (PID: 3536)

    • Deletes shadow copies

      • cmd.exe (PID: 4072)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 4072)

    • Loads the Task Scheduler COM API

      • wbengine.exe (PID: 2580)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2240)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 2432)

    • Uses ICACLS.EXE to modify access control list

      • wannacry.exe (PID: 2044)

    • Uses ATTRIB.EXE to modify file attributes

      • wannacry.exe (PID: 2044)

    • Executable content was dropped or overwritten

    • Drops a file with too old compile date

    • Creates files like Ransomware instruction

      • wannacry.exe (PID: 2044)

    • Starts CMD.EXE for commands execution

    • Creates files in the program directory

      • wannacry.exe (PID: 2044)

    • Creates files in the user directory

      • wannacry.exe (PID: 2044)
      • taskhsvc.exe (PID: 3232)

    • Drops a file that was compiled in debug mode

    • Executed via COM

      • vdsldr.exe (PID: 3196)

    • Executed as Windows Service

      • vssvc.exe (PID: 2856)
      • wbengine.exe (PID: 2580)
      • vds.exe (PID: 3220)

    • Creates files in the Windows directory

      • wbadmin.exe (PID: 2772)

    • Low-level read access rights to disk partition

      • wbengine.exe (PID: 2580)
      • vds.exe (PID: 3220)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2168)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2696)

    • Application launched itself

      • firefox.exe (PID: 1808)
      • firefox.exe (PID: 2696)

    • Creates files in the program directory

      • firefox.exe (PID: 2696)

    • Dropped object may contain Bitcoin addresses

      • wannacry.exe (PID: 2044)
      • taskhsvc.exe (PID: 3232)

    • Dropped object may contain TOR URL's

      • wannacry.exe (PID: 2044)

    • Dropped object may contain URL to Tor Browser

      • wannacry.exe (PID: 2044)

    • Creates files in the user directory

      • firefox.exe (PID: 2696)

    • Changes settings of System certificates

      • pingsender.exe (PID: 696)
      • pingsender.exe (PID: 3184)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 3184)
      • pingsender.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
35
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe #WANNACRY wannacry.exe attrib.exe no specs icacls.exe no specs taskdl.exe no specs cmd.exe no specs cscript.exe no specs @[email protected] #WANNACRY cmd.exe no specs @[email protected] no specs taskhsvc.exe searchprotocolhost.exe no specs pingsender.exe pingsender.exe cmd.exe vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs taskdl.exe no specs @[email protected] no specs cmd.exe no specs reg.exe taskdl.exe no specs @[email protected] no specs

Process information

PID
CMD
Path
Indicators
Parent process
1808"C:\Program Files\Mozilla Firefox\firefox.exe" "https://originaldll.com/file/wannacry.exe/41397.html"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2696"C:\Program Files\Mozilla Firefox\firefox.exe" https://originaldll.com/file/wannacry.exe/41397.htmlC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2524"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2696.0.687701834\2089268416" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2696 "\\.\pipe\gecko-crash-server-pipe.2696" 1160 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3936"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2696.3.473077936\1028484985" -childID 1 -isForBrowser -prefsHandle 1732 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2696 "\\.\pipe\gecko-crash-server-pipe.2696" 1752 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2648"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2696.13.1754633343\1790664762" -childID 2 -isForBrowser -prefsHandle 2516 -prefMapHandle 2496 -prefsLen 5997 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2696 "\\.\pipe\gecko-crash-server-pipe.2696" 2676 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2256"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2696.20.1654665529\2029007280" -childID 3 -isForBrowser -prefsHandle 3820 -prefMapHandle 3824 -prefsLen 7734 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2696 "\\.\pipe\gecko-crash-server-pipe.2696" 3852 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2044"C:\Users\admin\Downloads\wannacry.exe" C:\Users\admin\Downloads\wannacry.exe
firefox.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DiskPart
Exit code:
1073807364
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\downloads\wannacry.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1236attrib +h .C:\Windows\system32\attrib.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2080icacls . /grant Everyone:F /T /C /QC:\Windows\system32\icacls.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
3024taskdl.exeC:\Users\admin\Downloads\taskdl.exe—wannacry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
SQL Client Configuration Utility EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\downloads\taskdl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp60.dll
c:\windows\system32\msvcrt.dll
Total events
1 936
Read events
1 868
Write events
66
Delete events
2

Modification events

(PID) Process:(1808) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
DFECB01A01000000
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
C3D6B61A01000000
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2696) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2044) wannacry.exeKey:HKEY_CURRENT_USER\Software\WanaCrypt0r
Operation:writeName:wd
Value:
C:\Users\admin\Downloads
(PID) Process:(3536) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3536) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
20
Suspicious files
746
Text files
526
Unknown types
169

Dropped files

PID
Process
Filename
Type
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:5027177F513CDAE07DB2330E1DED5934
SHA256:0C53F16051E738287A4612F68E296238087627E594CFD6DDFA1FECC2E998328B
2696firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:354459382F30B8994109C88659DFA1F3
SHA256:E3E8E2B7E7EECA231620D83C70FA5A926E8B9CE74C51F595F71191DC0B50527E
2696firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\656A056292E7258499640A36275A62091C731CA7der
MD5:16EF20085181A2F99D17239A3FF14E3D
SHA256:6E5C183A2186A30A375F72BC2EECC97B02D96575282998DF529502D417F19E76
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
111
DNS requests
184
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
92.122.214.144:80
http://ocsp.int-x3.letsencrypt.org/
unknown
der
527 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
2696
firefox.exe
POST
200
172.217.18.3:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2696
firefox.exe
216.58.206.2:443
partner.googleadservices.com
Google Inc.
US
whitelisted
2696
firefox.exe
172.217.22.34:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
2696
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2696
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
2696
firefox.exe
172.217.18.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2696
firefox.exe
52.41.230.109:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2696
firefox.exe
65.9.68.6:443
firefox.settings.services.mozilla.com
AT&T Services, Inc.
US
malicious
2696
firefox.exe
92.122.214.144:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
unknown
2696
firefox.exe
88.212.201.210:443
counter.yadro.ru
United Network LLC
RU
suspicious
2696
firefox.exe
172.217.18.98:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
whitelisted
search.services.mozilla.com
  • 52.41.230.109
  • 44.238.74.153
  • 34.218.9.172
whitelisted
search.r53-2.services.mozilla.com
  • 34.218.9.172
  • 44.238.74.153
  • 52.41.230.109
whitelisted
originaldll.com
  • 176.9.61.4
whitelisted
push.services.mozilla.com
  • 52.26.177.54
whitelisted
autopush.prod.mozaws.net
  • 52.26.177.54
whitelisted
snippets.cdn.mozilla.net
  • 65.9.68.82
  • 65.9.68.94
  • 65.9.68.124
  • 65.9.68.17
whitelisted
d228z91au11ukj.cloudfront.net
  • 65.9.68.17
  • 65.9.68.124
  • 65.9.68.94
  • 65.9.68.82
whitelisted
ocsp.int-x3.letsencrypt.org
  • 92.122.214.144
  • 92.122.214.152
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3232
taskhsvc.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 828
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 663
3232
taskhsvc.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 293
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3232
taskhsvc.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://originaldll.com/file/wannacry.exe/41397.html