Resubmissions
20/10/2026, 18:56
261020-xlvrpatzfx820/10/2026, 18:50
261020-xg5q4atzav820/10/2026, 14:36
261020-ry31ya1vez820/10/2026, 14:11
261020-rhn7vaaw7t820/10/2026, 14:08
261020-rfsggsaw4v820/10/2026, 13:04
261020-qa43na1v2m820/10/2026, 07:27
261020-jabb1sw1bs820/10/2026, 06:59
261020-hr4t8aet6t8Analysis
- max time kernel
899s - max time network
463s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 13:04
General
- Target ransomware/WanaDecrypt0r.exe
- Size 7.7MB
- Sample261020-qa43na1v2m
- SHA256 37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\Run.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bqtz5fe\2bqtz5fe.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES623B.tmp" "c:\Users\Admin\AppData\Local\Temp\2bqtz5fe\CSCD8893C76A9814A4CBBFC6112BA54ADF.TMP"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\LockScreen.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
2bqtz5fe.dll
RES623B.tmp
FileCryptography.psm1
LockScreen.ps1
RanSim.ps1
Run.ps1
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
base_library.zip
python312.dll
ucrtbase.dll
__PSScriptPolicyTest_3drcoggs.xrw.psm1
2bqtz5fe.0.cs
2bqtz5fe.cmdline
CSCD8893C76A9814A4CBBFC6112BA54ADF.TMP
memory/4184-86-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-84-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-87-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-88-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-89-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-95-0x0000015AEB350000-0x0000015AEB36E000-memory.dmp
memory/4184-96-0x0000015AEB370000-0x0000015AEB422000-memory.dmp
memory/4184-97-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-98-0x0000015AEB530000-0x0000015AEB53A000-memory.dmp
memory/4184-85-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-99-0x0000015AEB6B0000-0x0000015AEB6CE000-memory.dmp
memory/4184-82-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-81-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-80-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-79-0x0000015AEB0B0000-0x0000015AEB0D2000-memory.dmp
memory/4184-122-0x0000015AEB360000-0x0000015AEB368000-memory.dmp
memory/4184-76-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-124-0x00007FFB3D560000-0x00007FFB3DF04000-memory.dmp
memory/4184-75-0x00007FFB3D6EF000-0x00007FFB3D6F0000-memory.dmp