Resubmissions
20/10/2026, 18:56
261020-xlvrpatzfx820/10/2026, 18:50
261020-xg5q4atzav820/10/2026, 14:36
261020-ry31ya1vez820/10/2026, 14:11
261020-rhn7vaaw7t820/10/2026, 14:08
261020-rfsggsaw4v820/10/2026, 13:04
261020-qa43na1v2m820/10/2026, 07:27
261020-jabb1sw1bs820/10/2026, 06:59
261020-hr4t8aet6t8Analysis
- max time kernel
899s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 14:36
General
- Target ransomware/WanaDecrypt0r.exe
- Size 7.7MB
- Sample261020-ry31ya1vez
- SHA256 37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\Run.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xuy02rpl\xuy02rpl.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD31A.tmp" "c:\Users\Admin\AppData\Local\Temp\xuy02rpl\CSCF003C9EA42444F95B9994C79B26EC53.TMP"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\LockScreen.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RESD31A.tmp
FileCryptography.psm1
LockScreen.ps1
RanSim.ps1
Run.ps1
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
base_library.zip
python312.dll
ucrtbase.dll
__PSScriptPolicyTest_ex0lg3sk.d4k.psm1
xuy02rpl.dll
CSCF003C9EA42444F95B9994C79B26EC53.TMP
xuy02rpl.0.cs
xuy02rpl.cmdline
memory/3036-93-0x0000012070ED0000-0x0000012070EEE000-memory.dmp
memory/3036-99-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-90-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-88-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-94-0x0000012071360000-0x0000012071412000-memory.dmp
memory/3036-95-0x0000012070F00000-0x0000012070F0A000-memory.dmp
memory/3036-96-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-84-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-97-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-98-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-100-0x0000012070F30000-0x0000012070F4E000-memory.dmp
memory/3036-89-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-101-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-102-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-104-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-111-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-83-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-82-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-127-0x0000012070EE0000-0x0000012070EE8000-memory.dmp
memory/3036-81-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-79-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-129-0x00007FFB93080000-0x00007FFB93A24000-memory.dmp
memory/3036-78-0x0000012070E60000-0x0000012070E82000-memory.dmp
memory/3036-75-0x00007FFB9320F000-0x00007FFB93210000-memory.dmp