C3
CERBERUS-REv4.0 PRO
Malware Reverse Engineering & Triage
Lab Status:AIR-GAPPED (REMnux / FLARE-VM)
INetSim:DNS/HTTP ACTIVE
Unified Integration Layer Upload Sample Quick Detonation AI Copilot

ATTACK GRAPH & THREAT BLAST RADIUS VISUALIZER

INTERACTIVE CANVAS

Dynamic node-edge threat topology mapping spawned processes, dropped artifacts, memory hollowing, and C2 sockets.

Total Impacted Entities
9 Nodes
Spawned Processes
3
Files Dropped / Encrypted
3
Network / C2 Sockets
2
Registry Mutations
2
Blast Threat Score
98 / 100
Filter Tactic:
100%
PROBESEXTRACTS & RUNSINVOKESCREATES SERVICEENCRYPTSSCANS & INFECTSLAUNCHES UIEXEWannaCry.exeTA0001C2Killswitch Domain QueryTA0011PIDtasksche.exeTA0002PIDvssadmin.exe Wipe ShadowsTA0005REGmssecsvc2.0 ServiceTA0003FILEEncrypted Files (*.WNCRY)TA0040C2SMBv1 445 Remote PropagationTA0008FILE@WanaDecryptor@.exe UITA0040
MALWARE BINARY
DROPPED FILE
SPAWNED PROCESS
REGISTRY MUTATION
NETWORK SOCKET
INJECTED MEMORY
LSASS ACCESS
Forensic Evidence Drawer
Initial Infection Binary
MALWARE BINARYInitial Access & Execution
Artifact Telemetry
Path / Endpoint:C:\Users\Victim\Desktop\WannaCry.exe
Process ID / Port:PID 3412
SHA-256 / Memory Base:24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
Full Command Line:
C:\Users\Victim\Desktop\WannaCry.exe
MITRE Technique:T1190 - Exploit Public-Facing Application (EternalBlue SMB)
Threat Impact & Blast Analysis

Entry detonation binary executing killswitch DNS probe and deploying payload modules.