Overview

overview

8

Static

static

3

ransomware...0r.exe

windows10-2004-x64

8

ransomware...0r.exe

windows11-ltsc_2024-x64

8

Resubmissions

20/10/2026, 18:56

261020-xlvrpatzfx8

20/10/2026, 18:50

261020-xg5q4atzav8

20/10/2026, 14:36

261020-ry31ya1vez8

20/10/2026, 14:11

261020-rhn7vaaw7t8

20/10/2026, 14:08

261020-rfsggsaw4v8

20/10/2026, 13:04

261020-qa43na1v2m8

20/10/2026, 07:27

261020-jabb1sw1bs8

20/10/2026, 06:59

261020-hr4t8aet6t8

Analysis

  • max time kernel
    899s
  • max time network
    550s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 06:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ransomware/WanaDecrypt0r.exe
  • Size 7.7MB
  • Sample261020-hr4t8aet6t
  • SHA256 37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 5 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5732
    • C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
      "C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5520
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\Run.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Sets desktop wallpaper using registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tzhdxzy3\tzhdxzy3.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1788
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78FF.tmp" "c:\Users\Admin\AppData\Local\Temp\tzhdxzy3\CSCCBEE2F9CBB904E56856BEDB7F26D9342.TMP"
            5⤵
              PID:960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\LockScreen.ps1"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2036
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4728
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3424
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5232
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2436
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:3064

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              @[email protected]
              • Path C:\USERS\ADMIN\DESKTOP\@[email protected]
              • Size 619B
              • SHA256 7c83ce552adc59621b7e99f5bc4d8bbf1bc660250c26a47019b7e4332a6d3a46
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              APPROVEASSERT.TXT.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\APPROVEASSERT.TXT.WNCRY
              • Size 264KB
              • SHA256 52c2854e3222be6150dddd688c3aab395a27a81d3a24fa7db55e7371b991f7cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DENYPUSH.MPG.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\DENYPUSH.MPG.WNCRY
              • Size 554KB
              • SHA256 da41d9b39d350c1b7553ffc02e6af5e95af0ef2dfa2c78f0418d754adab00ca6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OUTSKIP.XLSX.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\OUTSKIP.XLSX.WNCRY
              • Size 12KB
              • SHA256 cd6e027bd926998361d8ce75f37f1cc1723c85e47a4d3a81a93f9fddf4fa13af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RESTOREASSERT.MIDI.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\RESTOREASSERT.MIDI.WNCRY
              • Size 502KB
              • SHA256 2cf3b5077276091a08470a7ce47aa0378438260046b1b1edaa770d6800c69828
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              STARTUSE.PPTM.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\STARTUSE.PPTM.WNCRY
              • Size 536KB
              • SHA256 098f9bb2d1216dc592914ddd08d0fee14ba03c7c7271b6b3bd31670bb161a7ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              STOPMOUNT.MIDI.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\STOPMOUNT.MIDI.WNCRY
              • Size 383KB
              • SHA256 2787b00bc07180fa85d6c3aa57b4efe4af82ab7f19b3f85eee48f97f0a4c64d0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SYNCPUSH.DOCX.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\SYNCPUSH.DOCX.WNCRY
              • Size 639KB
              • SHA256 6ed7ca1a0ef4c9210db05ed745ac18d10e882387ecc42b860952baa22a929942
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WRITECOMPARE.DOCM.WNCRY
              • Path C:\USERS\ADMIN\DESKTOP\WRITECOMPARE.DOCM.WNCRY
              • Size 485KB
              • SHA256 db142f1d7432658db9600f2be03cb590f805f192f300d091c1acba80984682f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 8f115b2f85ada340d5c18856c6fabbc6ac1dc6fce9c7294d9d216a63fec333f3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RES78FF.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES78FF.tmp
              • Size 1KB
              • SHA256 023fb43c8d4b901e3517cedd0184d6d607fc7cc95aff41441e1d83453aff61bf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              FileCryptography.psm1
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\FileCryptography.psm1
              • Size 14KB
              • SHA256 bb970dffceeedeac03b78e0500d19d23a2cf7a8d80362912ba216d0a5e8eb5db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LockScreen.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\LockScreen.ps1
              • Size 4KB
              • SHA256 20b8d4a4415663decf6ab4f8955c7344d9273e5cf1bf0de411a5f61474789dae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RanSim.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\RanSim.ps1
              • Size 2KB
              • SHA256 4de8dd007b04ec7e26ce3610e8633bbcadf6284332d9ab1d84b6c8b3fd8c50f7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Run.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\Run.ps1
              • Size 5KB
              • SHA256 134b1372b1a1c7a4c165d80bad8fbbb0d34ffcfb7beeb6d9449eef01418f1898
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\_bz2.pyd
              • Size 84KB
              • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\_lzma.pyd
              • Size 157KB
              • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\base_library.zip
              • Size 1.3MB
              • SHA256 9239f156b250cb337d7ead19b66df2b98df2ae2a5e7be7c7d77c6dd4405e144d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python312.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\python312.dll
              • Size 6.6MB
              • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ucrtbase.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI000016642\ucrtbase.dll
              • Size 1.1MB
              • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_p31guxnf.na0.psm1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p31guxnf.na0.psm1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tzhdxzy3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\tzhdxzy3\tzhdxzy3.dll
              • Size 3KB
              • SHA256 e1d544b7c42495c17d054fbb226c42d7345d2d110466b2bdb16cbdab3a851d0c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CSCCBEE2F9CBB904E56856BEDB7F26D9342.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\tzhdxzy3\CSCCBEE2F9CBB904E56856BEDB7F26D9342.TMP
              • Size 652B
              • SHA256 b7761746e38fcc59b81847809216da58607f9a48db495bc80fb037412a305084
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tzhdxzy3.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\tzhdxzy3\tzhdxzy3.0.cs
              • Size 347B
              • SHA256 e81bfd35c30fa0f52ab9a07ac1edded6c6605ccecc1f88ba6a9cea0f540651c0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tzhdxzy3.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\tzhdxzy3\tzhdxzy3.cmdline
              • Size 369B
              • SHA256 7603d25ded32d34a425c384a4a54503052dba45a0677a1cee1a53f7b3d8fe6f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2108-81-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-82-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-110-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-108-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-99-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-98-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-124-0x0000021D41160000-0x0000021D41168000-memory.dmp
              Download

              memory/2108-96-0x0000021D41160000-0x0000021D4117E000-memory.dmp
              Download

              memory/2108-126-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-95-0x0000021D41110000-0x0000021D4111A000-memory.dmp
              Download

              memory/2108-94-0x0000021D41390000-0x0000021D41442000-memory.dmp
              Download

              memory/2108-93-0x0000021D41120000-0x0000021D4113E000-memory.dmp
              Download

              memory/2108-89-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-90-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-88-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-109-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-83-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-80-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-79-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
              Download

              memory/2108-78-0x0000021D28CF0000-0x0000021D28D12000-memory.dmp
              Download

              memory/2108-75-0x00007FFA371CF000-0x00007FFA371D0000-memory.dmp
              Download

              memory/3424-340-0x000000000EAB0000-0x000000000EB5E000-memory.dmp
              Download

              memory/5232-196-0x000002AE83C90000-0x000002AE83CB0000-memory.dmp
              Download

              memory/5232-152-0x000002AE801E0000-0x000002AE802E0000-memory.dmp
              Download

              memory/5232-154-0x000002AE801E0000-0x000002AE802E0000-memory.dmp
              Download

              memory/5232-210-0x000002AE94700000-0x000002AE94720000-memory.dmp
              Download

              memory/5232-178-0x000002AE93E90000-0x000002AE93F90000-memory.dmp
              Download

              memory/5232-176-0x000002AE83A30000-0x000002AE83A50000-memory.dmp
              Download

              memory/5232-153-0x000002AE801E0000-0x000002AE802E0000-memory.dmp
              Download