24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.WannaCryptor Sample 09a46b3e1be0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 09a46b3e1be0…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa","keywords":["Malicious","Trojan.Ransom.WannaCryptor","malware analysis","sandbox report","threat intelligence","09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.WannaCryptor","antivirusDetections":{"malicious":25,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T59f,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00030926-00002272) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00030936-00003644) Spawned process "taskdl.exe" (UID: 00032371-00003416) Spawned process "cmd.exe" with commandline "cmd /c 33621539367196.bat" (UID: 00032430-00002936) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00032485-00003144) Spawned process "taskdl.exe" (UID: 00035880-00004040) Spawned process "taskdl.exe" (UID: 00040369-00002020) Spawned process "taskdl.exe" (UID: 00044812-00002688) Spawned process "taskdl.exe" (UID: 00049508-00001480) Spawned process "@WanaDecryptor@.exe" with commandline "co" (UID: 00049727-00003152) Spawned process "cmd.exe" with commandline "/c start /b @WanaDecryptor@.exe vs" (UID: 00049753-00003288) Spawned process "@WanaDecryptor@.exe" with commandline "vs" (UID: 00049868-00002332) Spawned process "taskse.exe" with commandline "C:\@WanaDecryptor@.exe" (UID: 00050446-00000764) Spawned process "@WanaDecryptor@.exe" (UID: 00050480-00002660) Spawned process "cmd.exe" with commandline "/c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ..." (UID: 00050498-00002236) Spawned process "reg.exe" with commandline "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v " ..." (UID: 00050686-00002588), Spawned process "@WanaDecryptor@.exe" (UID: 00052887-00003680)26:T59f,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00030926-00002272) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00030936-00003644) Spawned process "taskdl.exe" (UID: 00032371-00003416) Spawned process "cmd.exe" with commandline "cmd /c 33621539367196.bat" (UID: 00032430-00002936) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00032485-00003144) Spawned process "taskdl.exe" (UID: 00035880-00004040) Spawned process "taskdl.exe" (UID: 00040369-00002020) Spawned process "taskdl.exe" (UID: 00044812-00002688) Spawned process "taskdl.exe" (UID: 00049508-00001480) Spawned process "@WanaDecryptor@.exe" with commandline "co" (UID: 00049727-00003152) Spawned process "cmd.exe" with commandline "/c start /b @WanaDecryptor@.exe vs" (UID: 00049753-00003288) Spawned process "@WanaDecryptor@.exe" with commandline "vs" (UID: 00049868-00002332) Spawned process "taskse.exe" with commandline "C:\@WanaDecryptor@.exe" (UID: 00050446-00000764) Spawned process "@WanaDecryptor@.exe" (UID: 00050480-00002660) Spawned process "cmd.exe" with commandline "/c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ..." (UID: 00050498-00002236) Spawned process "reg.exe" with commandline "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v " ..." (UID: 00050686-00002588), Spawned process "@WanaDecryptor@.exe" (UID: 00052887-00003680)27:T412,".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\System32\attrib.exe" ".exe" touched file "C:\Windows\System32\icacls.exe" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\System32\crypt32.dll" ".exe" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "attrib.exe" touched file "C:\Windows\System32\en-US\attrib.exe.mui" "attrib.exe" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "icacls.exe" touched file "C:\Windows\System32\en-US\ICacls.exe.mui" "icacls.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\cscript.exe"28:T7bf,Found dropped filename "pspubws@godaddy[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@admaster.com[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@xplosion[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@barbie[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@beemp3s[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@hm.baidu[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lenovo[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allrecipes[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@skyrock[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@itau.com[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@85play[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@passport.126[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@pi.pardot[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@soundcloud[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@logly.co[2].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@eyeota[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.itau.com[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@CAGW7CDR.txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@g.58[1].txt.WNCRYT" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@gloomwrite[2].txt.WNCRYT" containing the Windows username "PSPUBWS"29:Tb4b,"C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Desktop\~SDF860.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\~SDF8BB.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\~SDF8C6.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\~SDF8EF.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ItemTemplates\~SDF8FA.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ProjectTemplates\~SDF923.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Default\Desktop\~SDF99C.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Default\Desktop\~SDF9A7.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Desktop\~SDF9E4.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Public\Desktop\~SDF9E5.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Default\Documents\~SDFA9B.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Default\Documents\~SDFAC4.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\~SDFACF.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\~SDFAD0.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\~SDFAEF.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ItemTemplates\~SDFAFA.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ProjectTemplates\~SDFB23.tmp" for deletion "C:\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" marked "C:\Users\Public\Documents\~SDFB24.tmp" for deletion "C:\taskdl.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\1.WNCRYT" for deletion "C:\taskdl.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\10.WNCRYT" for deletion2a:T7ef,".exe" opened "C:\00000000.res" with delete access ".exe" opened "C:\Users\Cn5qcKh\Desktop\~SDF860.tmp" with delete access ".exe" opened "C:\Users\Cn5qcKh\Documents\~SDF8BB.tmp" with delete access ".exe" opened "C:\Users\Cn5qcKh\Documents\Visual Studio 2008\~SDF8C6.tmp" with delete access ".exe" opened "C:\Users\Cn5qcKh\Documents\Visual Studio 2008\Templates\~SDF8EF.tmp" with delete access ".exe" opened "C:\Users\Cn5qcKh\Documents\Visual Studio 2008\Templates\ItemTemplates\~SDF8FA.tmp" with delete access ".exe" opened "C:\Users\Cn5qcKh\Documents\Visual Studio 2008\Templates\ProjectTemplates\~SDF923.tmp" with delete access ".exe" opened "C:\Users\Default\Desktop\~SDF99C.tmp" with delete access ".exe" opened "C:\Users\Default User\Desktop\~SDF9A7.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Desktop\~SDF9E4.tmp" with delete access ".exe" opened "C:\Users\Public\Desktop\~SDF9E5.tmp" with delete access ".exe" opened "C:\Users\Default\Documents\~SDFA9B.tmp" with delete access ".exe" opened "C:\Users\Default User\Documents\~SDFAC4.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\~SDFACF.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Visual Studio 2008\~SDFAD0.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\~SDFAEF.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ItemTemplates\~SDFAFA.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ProjectTemplates\~SDFB23.tmp" with delete access ".exe" opened "C:\Users\Public\Documents\~SDFB24.tmp" with delete access "taskdl.exe" opened "C:\Users\Cn5qcKh\AppData\Local\Temp\1.WNCRYT" with delete access2b:T62f,65/79 Antivirus vendors marked spawned process "taskdl.exe" (PID: 3416) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 82% detection rate) 65/79 Antivirus vendors marked spawned process "taskdl.exe" (PID: 4040) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 82% detection rate) 65/79 Antivirus vendors marked spawned process "taskdl.exe" (PID: 2020) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 82% detection rate) 65/79 Antivirus vendors marked spawned process "taskdl.exe" (PID: 2688) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 82% detection rate) 65/79 Antivirus vendors marked spawned process "taskdl.exe" (PID: 1480) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 82% detection rate) 67/78 Antivirus vendors marked spawned process "@WanaDecryptor@.exe" (PID: 3152) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 85% detection rate) 67/78 Antivirus vendors marked spawned process "@WanaDecryptor@.exe" (PID: 2332) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 85% detection rate) 64/79 Antivirus vendors marked spawned process "taskse.exe" (PID: 764) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 81% detection rate) 67/78 Antivirus vendors marked spawned process "@WanaDecryptor@.exe" (PID: 2660) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 85% detection rate) 67/78 Antivirus vendors marked spawned process "@WanaDecryptor@.exe" (PID: 3680) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 85% detection rate)2c:T685,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 60) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 60) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 60) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 60) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 60) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 60) ".exe" wrote 32 bytes to a remote process "C:\taskdl.exe" (Handle: 228) ".exe" wrote 52 bytes to a remote process "C:\taskdl.exe" (Handle: 228) ".exe" wrote 4 bytes to a remote process "C:\taskdl.exe" (Handle: 228) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 88) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 88) "cmd.exe" wrote 32 bytes to a remote process "C:\@WanaDecryptor@.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\@WanaDecryptor@.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\@WanaDecryptor@.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84)2d:T114c,YARA signature "WannaDecryptor" classified file "09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_" YARA signature "WannaCry_RansomwareEx" classified file "09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly)) YARA signature "win_wannacryptor_g0" classified file "@WanaDecryptor@.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "unzip 0.15 Copyright 1998 Gilles Vollant,inflate 1.1.3 Copyright 1995-1998 Mark Adler,GetLogicalDrives,GetDriveType,FindFirstFileA,FindNextFileA,CryptImportKey,525341320008000001000100,/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" (Author: Daniel Plohmann fkie.fraunhofer.de>) YARA signature "WannCry_m_vbs" classified file "m.vbs" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: ".TargetPath = "C:\@ .CreateShortcut("C:\@, = WScript.CreateObject("WScript.Shell")" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth), YARA signature "WannCry_m_vbs" classified file "33621539367196.bat" as "ransomware wcry wannacry wanacrypt0r" based on indicators: ".TargetPath = "C:\@,.CreateShortcut("C:\@ = WScript.CreateObject("WScript.Shell")" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth), YARA signature "WannCry_BAT" classified file "33621539367196.bat" as "ransomware wcry wannacry wanacrypt0r" based on indicators: "@.exe">> m.vbs,cscript.exe //nologo m.vbs,echo SET ow = WScript.CreateObject("WScript.Shell")> ,echo om.Save>> m.vbs" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth) YARA signature "win_wannacryptor_g0" classified file "u.wnry" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "unzip 0.15 Copyright 1998 Gilles Vollant,inflate 1.1.3 Copyright 1995-1998 Mark Adler,GetLogicalDrives,GetDriveType,FindFirstFileA,FindNextFileA,CryptImportKey,525341320008000001000100,/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" (Author: Daniel Plohmann fkie.fraunhofer.de>) YARA signature "WannCry_m_vbs" classified process "09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: ".TargetPath = "C:\@ .CreateShortcut("C:\@, = WScript.CreateObject("WScript.Shell")" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth), YARA signature "WannCry_BAT" classified process "09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe" as "ransomware wcry wannacry wanacrypt0r" based on indicators: "@.exe">> m.vbs,cscript.exe //nologo m.vbs,echo SET ow = WScript.CreateObject("WScript.Shell")> ,echo om.Save>> m.vbs" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth) YARA signature "WanaCrypt0r" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "WanaDecryptor,Wana Decrypt0r,WanaCrypt0r,.wnry,bitcoin,vssadmin" (Author: Leo Fernandes - iDefense) YARA signature "WannCry_m_vbs" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: ".TargetPath = "C:\@ .CreateShortcut("C:\@, = WScript.CreateObject("WScript.Shell")" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth), YARA signature "WannCry_BAT" classified file "all.bstring" as "ransomware wcry wannacry wanacrypt0r" based on indicators: "@.exe">> m.vbs,cscript.exe //nologo m.vbs,echo SET ow = WScript.CreateObject("WScript.Shell")> ,echo om.Save>> m.vbs" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth) YARA signature "WannaDecryptor" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,s.wnry,t.wnry,msg/m_"2e:T640,Spawned process ".exe" (UID: 00030330-00002748) Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00030926-00002272) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00030936-00003644) Spawned process "taskdl.exe" (UID: 00032371-00003416) Spawned process "cmd.exe" with commandline "cmd /c 33621539367196.bat" (UID: 00032430-00002936) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00032485-00003144) Spawned process "taskdl.exe" (UID: 00035880-00004040) Spawned process "taskdl.exe" (UID: 00040369-00002020) Spawned process "taskdl.exe" (UID: 00044812-00002688) Spawned process "taskdl.exe" (UID: 00049508-00001480) Spawned process "@WanaDecryptor@.exe" with commandline "co" (UID: 00049727-00003152) Spawned process "cmd.exe" with commandline "/c start /b @WanaDecryptor@.exe vs" (UID: 00049753-00003288) Spawned process "@WanaDecryptor@.exe" with commandline "vs" (UID: 00049868-00002332) Spawned process "taskse.exe" with commandline "C:\@WanaDecryptor@.exe" (UID: 00050446-00000764) Spawned process "@WanaDecryptor@.exe" (UID: 00050480-00002660) Spawned process "cmd.exe" with commandline "/c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qojvojqahz344" /t REG_SZ /d "\"C:\tasksche.exe\"" /f" (UID: 00050498-00002236) Spawned process "reg.exe" with commandline "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qojvojqahz344" /t REG_SZ /d "\"C:\tasksche.exe\"" /f" (UID: 00050686-00002588) Spawned process "@WanaDecryptor@.exe" (UID: 00052887-00003680)2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790438655299,"unified_at":"2026-09-26T16:04:15.299Z","metadata":{"hashes":{"sha256":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa","sha1":"87420a2791d18dad3f18be436045280a4cc16fc4","md5":"509c41ec97bb81b0567b059aa2f50fe8","sha512":"fa7e6863f5f00ea73a09a8ab71937cf29094695a250c7510983d81d51e4775be4d417748b349f0a71f8d675a4943615b61c5dfdd0ad51d7402a9746c10ce1289","ssdeep":"98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB","ssdeep_chunks":["98304:QqPoBhz","98304:qPoBhz1","98304:PoBhz1a","98304:oBhz1aR","98304:Bhz1aRx","98304:hz1aRxc","98304:z1aRxcS","98304:1aRxcSU","98304:aRxcSUD","98304:RxcSUDk","98304:xcSUDk3","98304:cSUDk36","98304:SUDk36S","98304:UDk36SA","98304:Dk36SAE","98304:k36SAEd","98304:36SAEdh","98304:6SAEdhv","98304:SAEdhvx","98304:AEdhvxW","98304:EdhvxWa","98304:dhvxWa9","98304:hvxWa9P","98304:vxWa9P5","98304:xWa9P59","98304:Wa9P593","98304:a9P593R","98304:9P593R8","98304:P593R8y","98304:593R8yA","98304:93R8yAV","98304:3R8yAVp","98304:R8yAVp2","98304:8yAVp2g","98304:yAVp2g3","98304:AVp2g3x","196608:QqPoBhz","196608:qPoBhz1","196608:PoBhz1a","196608:oBhz1aR","196608:Bhz1aRx","196608:hz1aRxc","196608:z1aRxcS","196608:1aRxcSU","196608:aRxcSUD","196608:RxcSUDk","196608:xcSUDk3","196608:cSUDk36","196608:SUDk36S","196608:UDk36SA","196608:Dk36SAE","196608:k36SAEd","196608:36SAEdh","196608:6SAEdhv","196608:SAEdhvx","196608:AEdhvxW","196608:EdhvxWa","196608:dhvxWa9","196608:hvxWa9P","196608:vxWa9P5","196608:xWa9P59","196608:Wa9P593","196608:a9P593R","196608:9P593R8","196608:P593R8y","196608:593R8yA","196608:93R8yAV","196608:3R8yAVp","196608:R8yAVp2","196608:8yAVp2g","196608:yAVp2g3","196608:AVp2g3x","98304:QqPe1Cx","98304:qPe1Cxc","98304:Pe1Cxcx","98304:e1Cxcxk","98304:1Cxcxk3","98304:Cxcxk3Z","98304:xcxk3ZA","98304:cxk3ZAE","98304:xk3ZAEU","98304:k3ZAEUa","98304:3ZAEUad","98304:ZAEUadz","98304:AEUadzR","98304:EUadzR8","98304:UadzR8y","98304:adzR8yc","98304:dzR8yc4","98304:zR8yc4g","98304:R8yc4gB"],"imphash":"68f013d7437aa653a8a98a05807afeb1"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3514368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286907000,"last_seen":1689688895000,"last_multi_scan":1689688895000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["crypt","cve-2017-0147","downloader","eqtonex","ransomware","stardustchollima","targeted","wanacrypt0r","wanaransomware","wannacry","wannacrypt","wcry","exploit","riskware"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":22,"suspicious_count":22,"malicious_count":9,"total":53},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.toNn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.WannaCryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Scatter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.JB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.38297717","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Wannacryptor-9940180-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.WannaCrypt.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.38297717 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.WannaCryptor.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Wannacry.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050d7171 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Wanna.zbu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-WannaCry!509C41EC97BB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.eorfmq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EMG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.WannaCry.Zen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.ZTSA-8671","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.WannaCry.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.WannaCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.WannaCry.Win32.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.WannaCryptor","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Persistence","technique":"File System Permissions Weakness","attack_id":"T1044","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1044","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"},{"type":"suspicious","value":"Grants permissions using icacls (DACL modification)"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00049727-00003152-42597-251-0040734A\n GetTimeZoneInformation@KERNEL32.dll at 55570-421-0040734A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00049727-00003152-42597-348-00403A20\n GetDiskFreeSpaceExW@KERNEL32.dll at 55570-560-00403A20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00030330-00002748-21705-12-004029CC\n GetProcessHeap@KERNEL32.DLL at 00030330-00002748-21705-11-004021E9\n GetProcessHeap@KERNEL32.DLL at 00030330-00002748-28280-12-004021E9\n GetProcessHeap@KERNEL32.DLL at 00030330-00002748-28280-13-004029CC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\MsWinZonesCacheCounterMutexA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MsWinZonesCacheCounterMutexA0\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00032485-00003144)","origin":"Monitored Target","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\System32\\riched32.dll\" at 73AF0000\n \"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6DCC0000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c 33621539367196.bat\" on 2018-10-12.10:59:56.369\n \"/c start /b @WanaDecryptor@.exe vs\" on 2018-10-12.11:06:09.969\n \"/c reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"qojvojqahz344\" /t REG_SZ /d \"\\\"C:\\tasksche.exe\\\"\" /f\" on 2018-10-12.11:06:17.670","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"@WanaDecryptor@.exe\" searching for window \"Wana Decrypt0r 2.0\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.bin\" (Offset: 553314)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"@WanaDecryptor@.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00049727-00003152-42597-172-0040BED0\n GetUserNameA@ADVAPI32.dll at 55570-304-0040BED0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"@WanaDecryptor@.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"@WanaDecryptor@.exe.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Oct 12 23:59:56 2018 mtime=Fri Oct 12 23:59:56 2018 atime=Fri May 12 15:22:56 2017 length=245760 window=hide\"\n \"m.vbs\" has type \"ASCII text with CRLF line terminators\"\n \"00000000.pky\" has type \"b.out pure executable 86 286 Large Text\"\n \"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QOJVOJQAHZ344\"; Value: \"\"C:\\tasksche.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"\n \"cscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Rh8PXod5$.vU\"\n Heuristic match: \"JHiWH|.Uy\"\n Pattern match: \"https://en.wikipedia.org/wiki/Bitcoin\"\n Pattern match: \"https://www.google.com/search?q=how+to+buy+bitcoin\"\n Pattern match: \"http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"@WanaDecryptor@.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"m.vbs\" contains indicator \"WScript.Shell\" (Line: 1; Offset: 31)\n \"33621539367196.bat\" contains indicator \"WScript.Shell\" (Line: 2; Offset: 36)","origin":"Binary File","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"@WanaDecryptor@.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00030330-00002748-21705-103-00401CE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1035","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00030330-00002748-00000105-12793793681","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99986797043","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$28","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskse.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00030330-00002748-21705-42-00401DAB\n LoadResource@KERNEL32.DLL at 00030330-00002748-28280-49-00401DAB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"@WanaDecryptor@.exe\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"@WanaDecryptor@.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"00000000.pky\" has type \"b.out pure executable 86 286 Large Text\"\n \"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"URLDownloadToFileA@URLMON.DLL at 00049727-00003152-42597-180-0040B780\n URLDownloadToFileA@urlmon.dll at 55570-318-004133CE\n URLDownloadToFileA@urlmon.dll at 55570-314-0040B780","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .sqlitedb\n .der\n .key\n .csr\n .pem\n .ott\n .stw\n .3ds\n .3dm\n .ots\n .stc\n .slk\n .odp\n .sxd\n .uop\n .otg\n .mml\n .lay6\n .sqlite3\n .accdb\n .db\n .odb\n .myd\n .ibd\n .ldf\n .cpp\n .asm\n .cmd\n .vb\n .dip\n .sch\n .asp\n .java\n .class\n .mp3\n .swf\n .wmv\n .vob\n .avi\n .mp4\n .mkv\n .flv\n .mid\n .m4u\n .ai\n .nef\n .cgm\n .gif\n .bmp\n .jpeg\n .rar\n .gz\n .tar\n .tbk\n .PAQ\n .aes\n .vmx\n .sldm\n .sti\n .602\n .pdf\n .wks\n .rtf\n .txt\n .edb","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and s\" (Source: 00030330-00002748-0000018C-11961859490, Indicator: \"files are encrypted\")\n \"Ooops, your files have been encrypted!\" (Source: 00049727-00003152.00000002.56222.00423000.00000002.mdmp, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1245 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"@WanaDecryptor@.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"taskse.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00049727-00003152-42597-363-004035A0\n OpenClipboard@USER32.dll at 55570-576-004035A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"System Security","name":"Grants permissions using icacls (DACL modification)","description":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00030936-00003644)","origin":"Monitored Target","mitre_attack_id":"T1044","relevance":3,"id":"target-8","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n CreateServiceA\n RegCreateKeyW\n StartServiceA\n LoadLibraryA\n GetFileAttributesA\n CopyFileA\n VirtualProtect\n GetFileAttributesW\n GetModuleFileNameA\n GetStartupInfoA\n GetFileSize\n LockResource\n CreateDirectoryA\n CreateDirectoryW\n GetProcAddress\n GetComputerNameW\n GetFileSizeEx\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessA\n WriteFile\n Sleep\n CreateFileA\n FindResourceA\n VirtualAlloc\n GetUserNameA\n CopyFileW\n GetDriveTypeW\n FindFirstFileW\n FindNextFileW\n DeleteFileA\n CreateThread\n FindFirstFileA\n GetTempFileNameA\n GetComputerNameA\n FindNextFileA\n GetTickCount\n ShellExecuteExA\n ShellExecuteA\n FindWindowW\n recv\n socket\n bind\n send\n WSAStartup\n connect\n closesocket\n URLDownloadToFileA\n DeleteFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"@WanaDecryptor@.exe\" wrote bytes \"4053267758582777186a2777653c28770000000000bfe2750000000056cce275000000007ccae27500000000376860756a2c2877d62d287700000000206960750000000029a6e27500000000a48d607500000000f70ee27500000000\" to virtual address \"0x75681000\" (part of module \"NSI.DLL\")\n \"taskse.exe\" wrote bytes \"90bae275d333e3755c39e37541cfe27546bae275101ede7500000000cfd81376b43a1676a93a1676c0b2177675dc1376aa36127670d71376c02b127651c11176ad771a76ec321b76c3271276ce27127604281276e1e11176d8041b7600000000\" to virtual address \"0x00402000\" (part of module \"TASKSE.EXE\")\n \"reg.exe\" wrote bytes \"4053267758582777186a2777653c28770000000000bfe2750000000056cce275000000007ccae27500000000376860756a2c2877d62d287700000000206960750000000029a6e27500000000a48d607500000000f70ee27500000000\" to virtual address \"0x75681000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"@WanaDecryptor@.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/15 Antivirus vendors marked sample as malicious (80% detection rate)\n 59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/15 Antivirus vendors marked sample as malicious (80% detection rate)\n 59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"67/78 Antivirus vendors marked dropped file \"@WanaDecryptor@.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 85% detection rate)\n 17/57 Antivirus vendors marked dropped file \"m.vbs\" as malicious (classified as \"VBS_WCRY.COMQ\" with 29% detection rate)\n 64/79 Antivirus vendors marked dropped file \"taskse.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 81% detection rate)\n 65/79 Antivirus vendors marked dropped file \"taskdl.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 82% detection rate)\n 21/60 Antivirus vendors marked dropped file \"33621539367196.bat\" as malicious (classified as \"BAT_WCRY.BA\" with 35% detection rate)\n 67/78 Antivirus vendors marked dropped file \"u.wnry\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 85% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\WMR\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$2d","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00030936-00003644)","origin":"Monitored Target","mitre_attack_id":"T1044","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2e","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Grants permissions using icacls (DACL modification)"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["crypt","cve-2017-0147","downloader","eqtonex","ransomware","stardustchollima","targeted","wanacrypt0r","wanaransomware","wannacry","wannacrypt","wcry","exploit","riskware"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"59161ec8343bbeae9505cf40","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.WannaCryptor","submit_name":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.bin","analysis_start_time":"2018-10-12T10:57:01+00:00","indicators_count":{"informative":22,"suspicious":28,"malicious":10},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}],"processes":[{"pid":2748,"ppid":0,"name":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe","command_line":"","sha256":"09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa","normalized_path":"C:\\09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa.exe","uid":"00030330-00002748","icon":"$2f"},{"pid":2272,"ppid":2748,"name":"attrib.exe","command_line":"attrib +h .","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00030330-00002748","uid":"00030926-00002272"},{"pid":3644,"ppid":2748,"name":"icacls.exe","command_line":"icacls . /grant Everyone:F /T /C /Q","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00030330-00002748","uid":"00030936-00003644"},{"pid":3416,"ppid":2748,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00030330-00002748","uid":"00032371-00003416"},{"pid":2936,"ppid":2748,"name":"cmd.exe","command_line":"cmd /c 33621539367196.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030330-00002748","uid":"00032430-00002936"},{"pid":3144,"ppid":2936,"name":"cscript.exe","command_line":"//nologo m.vbs","sha256":"bd7b57a9303f0156e0737e9768a70f841b222a3e07e1426ecccfffdf2737bfe9","normalized_path":"%WINDIR%\\System32\\cscript.exe","parent_uid":"00032430-00002936","uid":"00032485-00003144"},{"pid":4040,"ppid":2748,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00030330-00002748","uid":"00035880-00004040"},{"pid":2020,"ppid":2748,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00030330-00002748","uid":"00040369-00002020"},{"pid":2688,"ppid":2748,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00030330-00002748","uid":"00044812-00002688"},{"pid":1480,"ppid":2748,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00030330-00002748","uid":"00049508-00001480"},{"pid":3152,"ppid":2748,"name":"@WanaDecryptor@.exe","command_line":"co","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","normalized_path":"C:\\@WanaDecryptor@.exe","parent_uid":"00030330-00002748","uid":"00049727-00003152"},{"pid":3288,"ppid":2748,"name":"cmd.exe","command_line":"/c start /b @WanaDecryptor@.exe vs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030330-00002748","uid":"00049753-00003288"},{"pid":2332,"ppid":3288,"name":"@WanaDecryptor@.exe","command_line":"vs","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","normalized_path":"C:\\@WanaDecryptor@.exe","parent_uid":"00049753-00003288","uid":"00049868-00002332"},{"pid":764,"ppid":2748,"name":"taskse.exe","command_line":"C:\\@WanaDecryptor@.exe","sha256":"2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d","normalized_path":"C:\\taskse.exe","parent_uid":"00030330-00002748","uid":"00050446-00000764"},{"pid":2660,"ppid":2748,"name":"@WanaDecryptor@.exe","command_line":"","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","normalized_path":"C:\\@WanaDecryptor@.exe","parent_uid":"00030330-00002748","uid":"00050480-00002660"},{"pid":2236,"ppid":2748,"name":"cmd.exe","command_line":"/c reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"qojvojqahz344\" /t REG_SZ /d \"\\\"C:\\tasksche.exe\\\"\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030330-00002748","uid":"00050498-00002236"},{"pid":2588,"ppid":2236,"name":"reg.exe","command_line":"reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"qojvojqahz344\" /t REG_SZ /d \"\\\"C:\\tasksche.exe\\\"\" /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00050498-00002236","uid":"00050686-00002588"},{"pid":3680,"ppid":2748,"name":"@WanaDecryptor@.exe","command_line":"","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","normalized_path":"C:\\@WanaDecryptor@.exe","parent_uid":"00030330-00002748","uid":"00052887-00003680"}],"all_imported_dlls":["winsta.dll","winbrand.dll","sxs.dll","setupapi.dll","slc.dll","gdi32.dll","usp10.dll","sechost.dll","iertutil.dll","nsi.dll","riched32.dll","ntdll.dll","riched20.dll","lpk.dll","imm32.dll","msisip.dll","cscapi.dll","kernel32.dll","cryptsp.dll","rsaenh.dll","shlwapi.dll","oleaut32.dll","msasn1.dll","propsys.dll","odbc32.dll","rpcrt4.dll","wshext.dll","mpr.dll","urlmon.dll","odbcint.dll","vbscript.dll","linkinfo.dll","userenv.dll","ole32.dll","dwmapi.dll","netutils.dll","shell32.dll","ntmarta.dll","sspicli.dll","scrobj.dll","profapi.dll","mfc42.dll","KernelBase.dll","msvcrt.dll","advapi32.dll","msvcp60.dll","comctl32.dll","msctf.dll","cryptbase.dll","uxtheme.dll","ulib.dll","version.dll","rpcss.dll","user32.dll","IconCodecService.dll","scrrun.dll","cfgmgr32.dll","ntshrui.dll","ws2_32.dll","wtsapi32.dll","tzres.dll","apphelp.dll","crypt32.dll","WindowsCodecs.dll","wininet.dll","msls31.dll","Wldap32.dll","clbcatq.dll","wintrust.dll","devobj.dll","srvcli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"33621539367196.bat","sha256":"f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"@WanaDecryptor@.exe","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"m.vbs","sha256":"51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"taskdl.exe","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"taskse.exe","sha256":"2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"@Please_Read_Me@.txt","sha256":"0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"00000000.eky","sha256":"7ffc18bddde7c588e524e131f279fb1702669c0e61b3301a63227e57b2a28690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"00000000.pky","sha256":"c3eb05aa83d750673fd47e6725c2e712afcbd7333f48f2ba436bc5891bb73606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"00000000.res","sha256":"78adef53a8fee85cd62726e48f7f7ee689d3a29cba8e4a08b39234ea3d412233","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"@WanaDecryptor@.exe.lnk","sha256":"dcf9e1e1acc0f450b32901900a0491d70b9ef7a340e0b90ec342fe61aa97d3fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"b.wnry","sha256":"d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"c.wnry","sha256":"78b5db2ee1e7921208db94b396e259b75f195e92ef02203846022a0259d96619","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"m_bulgarian.wnry","sha256":"40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"m_chinese (simplified).wnry","sha256":"845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"m_chinese (traditional).wnry","sha256":"5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"m_croatian.wnry","sha256":"3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}],"files_written":[{"path":"%WINDIR%\\System32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\icacls.exe","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\ICacls.exe.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\00000000.pky","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\00000000.eky","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\00000000.res","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\@Please_Read_Me@.txt","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\system32\\en\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\cscript.exe","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\m.vbs","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\@WanaDecryptor@.exe.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\@WanaDecryptor@.exe.lnk","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"path":"C:\\33621539367196.bat","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WANACRYPT0R\\","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MsWinZonesCacheCounterMutexA","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsWinZonesCacheCounterMutexA0","sources":[{"report_type":"sandbox","report_id":"59161ec8343bbeae9505cf40"}]}]}},"report_ids":{"sandbox_job_ids":["59161ec8343bbeae9505cf40"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Ransom.WannaCryptor Sample 09a46b3e1be0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 09a46b3e1be0…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.WannaCryptor Sample 09a46b3e1be0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 09a46b3e1be0…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.WannaCryptor Sample 09a46b3e1be0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 09a46b3e1be0…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]