37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransomware/WanaDecrypt0r.exe
Size 7.7MB
Sample261020-sg4ftabs5t
SHA256 37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149
MD5 80ae91891bdb20fc9ffbc35af0e1352b
SHA1 2c4606168d8491f3d6ad17f5e2cc4eba28dbd638
SHA512 4c34d95fd6b3fde9781c1be1e8cb3a8fc94d920844e8c79a74d54b33b62374129983fbc1c2e4e5b6e21d301a0bea039a6d165f248ebcb9d60389d4d6b2fe9d25
SSDEEP 196608:2r2eYdDAXurHSuhHToAUPNfGU5vXvE4LDdIOZ+:2KdEXuXhHTodRGkXs4/PA
TLSH
T189863365A3C599F9FEB3E93C96630245D3B63C061720C5DB02D986527E376F02A3A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4580	powershell.exe
3912	powershell.exe

Loads dropped DLL 5 IoCs

pid	Process
4252	WanaDecrypt0r.exe
4252	WanaDecrypt0r.exe
4252	WanaDecrypt0r.exe
4252	WanaDecrypt0r.exe
4252	WanaDecrypt0r.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeBackground.bmp"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeBackground.bmp"	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
3912	powershell.exe
3912	powershell.exe
3912	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4252	4376	WanaDecrypt0r.exe	88
PID 4252 wrote to memory of 4580	4252	WanaDecrypt0r.exe	89
PID 4580 wrote to memory of 4520	4580	powershell.exe	91
PID 4520 wrote to memory of 5288	4520	csc.exe	92
PID 4580 wrote to memory of 3912	4580	powershell.exe	93

C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
  "C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\Run.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0mu4x2ya\0mu4x2ya.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA89A.tmp" "c:\Users\Admin\AppData\Local\Temp\0mu4x2ya\CSC6B3591D11AD43AAB04862E274EC6B8.TMP"
        5⤵
        
        PID:5288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\LockScreen.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8f115b2f85ada340d5c18856c6fabbc6ac1dc6fce9c7294d9d216a63fec333f3
MD5 152a8a213f0bb60e3a57cc8b53f780e7
SHA1 0702bf4f40b7960cd5a81cc5825e02c22693af64
SHA512 4d1cc55e809003f0cceba53add5ecea6790ebd2d2cffc856cd8457009c35c2413f501503f248ddba26d3acb488e9a3c8b6d7c67695f8b838e0c005bc1bf4b9a3
TLSH
T108216833B3DC8615D899413A50CEEC1036B6C7DB80DECF6B7B85D649A53F699CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

0mu4x2ya.dll

Path C:\Users\Admin\AppData\Local\Temp\0mu4x2ya\0mu4x2ya.dll
Size 3KB
SHA256 74a59e5e9d1278dce98be65b0835171bb9b00312039fc06ec5c566d5672180a4
MD5 4ab8647f1769dae97f4dd19a3212ebcc
SHA1 3669b2762c6b2512cebe5a59dd5459213a40314f
SHA512 088303104103feb3f710e1ec8ba7cc50f2fd67ca9b3c31be125e5b772a998c08044c7eb92136eb372237e7d95f1c2ecb771b9d97812a02c2991ed2a17f62c37e
TLSH
T14251CC1A67E8466BE4AB47306EF3475337B5F8549F73A3294980122D9CA17681E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESA89A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA89A.tmp
Size 1KB
SHA256 006cf3a5f26ce67b991627d0d871265baa3b0eafeb34eba7b55313cba50963ac
MD5 5be15a1b0004eb73812367f645fb5103
SHA1 7858f408ff1ea121b7b45df18e7c3b1c062a112d
SHA512 4fd6aa392bbba4aa4c4b99990c7a29a1b7b9485eb6f90f96e1252fa2ebf239c40b29fa45d15a480d93df96af40be98d3661c2f9aaf2a5e7334619ed0b7413aa3
TLSH
T12221C005A3E9871FF0B7473169FA072FD2B5FD98EFA2535A4540023C1C41104EDA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

FileCryptography.psm1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\FileCryptography.psm1
Size 14KB
SHA256 bb970dffceeedeac03b78e0500d19d23a2cf7a8d80362912ba216d0a5e8eb5db
MD5 a528542f33dcb34418bae828deaa8b3e
SHA1 a56f9a88600d549b3ba831e977f036e46b6a50bd
SHA512 683020b8963ffe336679e1552d187a01713718790264ecad81da3c238338980444a7578b77da82b3143b2c03af1340d55a3786ea02e04b4ee9f5e84248c04272
SSDEEP 192:tm1oaf6XeydX5+wA8kMuL6ufzUL6ih6iPCD7Iu/kGyUB4p1CUFLDv6/7JbABjVuH:tm1Lyt5+z3M+6PCDCUB4p4oLr6ajJ+
TLSH
T1286295543F969AD503C220B5EA3EEA448735862F90792F18FBCCD104BF9251CE6A9BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockScreen.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\LockScreen.ps1
Size 4KB
SHA256 20b8d4a4415663decf6ab4f8955c7344d9273e5cf1bf0de411a5f61474789dae
MD5 e920d6359156f90ec5c43d7c07135360
SHA1 0c1efa1bafdc1fc287e5bd9b4a6b49e1656bb470
SHA512 6fb3d043e1a446189412b4055e35385b48b09bd90ea292702c7479d82db64d82c22db09748ce9f6df087aa7ef2d3999283b558709c15b4db30de2976cfad5b43
SSDEEP 96:lxD7b5D2eCQGWxMm+90c5s39slblPecDp5w5QjlcOGnBESywNKBj:lzywGqMm+90c5S9QRPecDpuKJcOG5ylV
TLSH
T12791442D7778D230A7D2A69DEAEBD885AD1A11365001D9043ADFE06CD76D025C3BB34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RanSim.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\RanSim.ps1
Size 2KB
SHA256 4de8dd007b04ec7e26ce3610e8633bbcadf6284332d9ab1d84b6c8b3fd8c50f7
MD5 8a7c56f4344a3c64016b71b71e5994ff
SHA1 7f7f234c8364aa255cba3c070bfc77737e64b6d3
SHA512 05a23939818a7fc0d016f0eb870bf755b64f10d4d7b48f929ba71d131db63accefb429f4046b60f2efced3a5778629d31f3a916149182f88e7f15b37c09685ea
TLSH
T1FE512E123EE457E59651268BEF7DE0097318A4BF76597B14B8CDA2003F02B1805DAAF3
MD5 SHA1 SHA512 TLSH

Submit Download

Run.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\Run.ps1
Size 5KB
SHA256 134b1372b1a1c7a4c165d80bad8fbbb0d34ffcfb7beeb6d9449eef01418f1898
MD5 ad0a4988cdbf19163ac660bb8bff897a
SHA1 760cdbb5a588dbf51f96160a984477eb515f1335
SHA512 ac83e79bc7930a44a664776b29bc7045e2dffa69b0f1c92be48113ea7ef6783d85269dd1b85cb2984100c812b713c126f4ee3b07e45cf233a11f21e536fff42a
SSDEEP 96:lxjxVyJU5qpo71FA+BSQJ3GB3WcUh7Yy2yQym975sJ9v5h49+5M9N56AkKgj0ksZ:lJt5qW71FjBD4B3WcUh7Yy2yQym97+J4
TLSH
T19CB10A2F7F26C51C8B93C06B9ABED441DB2415A701B5A80671CDE1D49F0D934C3BFAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\base_library.zip
Size 1.3MB
SHA256 9239f156b250cb337d7ead19b66df2b98df2ae2a5e7be7c7d77c6dd4405e144d
MD5 84989d2f5300ad618fd292eb5646606a
SHA1 31c8c2a39368007f3b6d5341c28d6d7f33e031b2
SHA512 b18f1ca8e568fe58ce826c6d9915d93bcb4be3c5e28c9c94f53e8eebfd36dacf6c68bb0f42a172164e1f823d57da590dc9dfc7ccba1bf3f78207a6a762e99d1d
SSDEEP 12288:iHbP1dm48lJGUmr/scrmn9bRO2Kfb9WcnVTVihlyixmpvQXMHYqNZ2/HliO:obP1dm48lJGU0p69bk9vhB2/HliO
TLSH
T17F55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011182\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nes4k1rq.bbb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nes4k1rq.bbb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0mu4x2ya.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0mu4x2ya\0mu4x2ya.0.cs
Size 347B
SHA256 e81bfd35c30fa0f52ab9a07ac1edded6c6605ccecc1f88ba6a9cea0f540651c0
MD5 ad0af73a7d23a7288b7513b3465ca8a8
SHA1 0492129408e1b1ac32c9a28272c2c5341a76780b
SHA512 8df38ebf810240aa9c9d29f454e35d121b4a9bcd136655796f1c11e687754ec55ff06ba2d94a49bf7c5b3d2c7d707e1ec3743e96175bc9c6b81bc232d72fe628
TLSH
T1B1E0D824B7C79EB9805340171C43A0E46B32811A22EA7902FAD91120CECB5042532B69
MD5 SHA1 SHA512 TLSH

Submit Download

0mu4x2ya.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0mu4x2ya\0mu4x2ya.cmdline
Size 369B
SHA256 7ede5dc2ace274e470ebc6f855c607c99311ef041a1a840ef9b7a81c4dfd81a7
MD5 a0fdf636c97bd15eba2657c15147aaa0
SHA1 26ff3c989e582052b09b4094dbbe210b22a030ad
SHA512 6c2f151ea9350452a217e243cbda6ad7e070e6432356f7d73867fe927d21e608b3a36a64b4c1d45b253952750d50d8e21a9bf64f00760989d8a61164b65f1955
TLSH
T197E0683E4346C27D81DA100B2D69C5AD83724743AA81FF845860444EE49709127D3741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6B3591D11AD43AAB04862E274EC6B8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0mu4x2ya\CSC6B3591D11AD43AAB04862E274EC6B8.TMP
Size 652B
SHA256 46abeea61896073d6efffa16920031695fb1dc40d489161895f2bc41c910403e
MD5 0413e41d1600d17d35d01dda171db076
SHA1 8cf48000dab3e21b91326f9688949bc5578d019e
SHA512 bb9645153c6c03ea89937ae27f85c31f2ab0680a7ace39d0d8f9ccc489c76d921594540a70d7cfe9bd0235c6335831c59f578fa619ef24ef8cdf3379feb874e6
TLSH
T1C5F05E0A63F8020EF0F38F30BDF6476395A9BC65DE3393ED1490032928645149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-85-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-98-0x000001CEB87A0000-0x000001CEB87BE000-memory.dmp

Download

memory/4580-86-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-87-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-88-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-96-0x000001CEB8470000-0x000001CEB8522000-memory.dmp

Download

memory/4580-97-0x000001CEB8240000-0x000001CEB824A000-memory.dmp

Download

memory/4580-95-0x000001CEB8450000-0x000001CEB846E000-memory.dmp

Download

memory/4580-83-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-84-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-107-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-82-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-80-0x000001CEB8190000-0x000001CEB81B2000-memory.dmp

Download

memory/4580-121-0x000001CEB8450000-0x000001CEB8458000-memory.dmp

Download

memory/4580-81-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-123-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-77-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-76-0x00007FFABEB50000-0x00007FFABF4F4000-memory.dmp

Download

memory/4580-75-0x00007FFABECDF000-0x00007FFABECE0000-memory.dmp

Download