download:

/limiteci/WannaCry/blob/main/WannaCry.EXE

Full analysis: https://app.any.run/tasks/12675e14-6e46-413d-b2c1-a5ed431d5fab
Verdict: Malicious activity
Analysis date: May 08, 2024, 09:41:37
OS: Ubuntu 22.04.2
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

84C82835A5D21BBCF75A61706D8AB549

SHA1:

5FF465AFAABCBF0150D1A3AB2C2E74F3A4426467

SHA256:

ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA

SSDEEP:

98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:20 09:05:05+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28672
InitializedDataSize: 3481600
UninitializedDataSize: -
EntryPoint: 0x77ba
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.1.7601.17514
ProductVersionNumber: 6.1.7601.17514
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: DiskPart
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName: diskpart.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: diskpart.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7601.17514
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
11
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs nautilus no specs locale-check no specs nautilus no specs file-roller no specs 7z no specs nautilus no specs file-roller no specs 7z no specs 7z no specs

Process information

PID
CMD
Path
Indicators
Parent process
9266/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/WannaCry\.EXE\.exe "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
9267sudo -iu user nautilus /tmp/WannaCry.EXE.exe/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
9268nautilus /tmp/WannaCry.EXE.exe/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
9269/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
9293nautilus /tmp/WannaCry.EXE.exe/usr/bin/nautilus—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9294file-roller /tmp/WannaCry.EXE.exe/usr/bin/file-roller—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9309/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/WannaCry.EXE.exe/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9317nautilus /tmp/WannaCry.EXE.exe/usr/bin/nautilus—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
9286
9318file-roller /tmp/WannaCry.EXE.exe/usr/bin/file-roller—nautilus
User:
user
Integrity Level:
UNKNOWN
9335/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/WannaCry.EXE.exe/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
9294
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
9268nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
9268nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
9268nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
9294file-roller/dconf/user —
MD5:—
SHA256:—
9268nautilus/home/user/.local/share/recently-used.xbel.GOP7M2 —
MD5:—
SHA256:—
9268nautilus/home/user/.local/share/recently-used.xbel.J5Z2M2 —
MD5:—
SHA256:—
93427z/home/user/.cache/.fr-iokZny/taskse.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.49:80
—
Canonical Group Limited
GB
unknown
—
—
91.189.91.98:80
—
Canonical Group Limited
US
unknown
—
—
185.125.190.96:80
—
Canonical Group Limited
GB
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.55
unknown
136.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::24
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::198
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/limiteci/WannaCry/blob/main/WannaCry.EXE