MULTI-SANDBOX BEHAVIORAL COMPARATORDUAL-EXECUTION DELTA
Differential Execution Studio
Compare simultaneous execution runs across isolated sandboxes. Detect evasion heuristics, killswitch sinkhole reactions, anti-VM triggers, and execution branch divergence.
TARGET SAMPLE
COMPARISON PROFILE
BEHAVIORAL DIVERGENCE
94%HIGH EVASION
Execution path split detected between sandboxes.
SANDBOX PROFILE A
Air-Gapped INetSim / FakeNet Sandbox
Isolation mode active. Synthetic DNS/HTTP responses.
SANDBOX PROFILE B
Live C2 Callback Controlled Sandbox
Full network egress / live C2 callback enabled.
EVASION TECHNIQUES
2DETECTED
Anti-analysis checks altered runtime behaviors.
CRITICAL BEHAVIORAL BRANCHING (KILLSWITCH TRIGGER)
In Run A (Air-gapped INetSim), the sinkhole answered HTTP GET with status 200 OK. WannaCry identified the killswitch domain as alive and deliberately exited cleanly without file encryption. In Run B (Live / NXDOMAIN), the domain resolution failed, triggering payload decompression, shadow copy deletion, and multi-threaded ransomware encryption.
Comparing process hierarchy and child command executions between Run A and Run B.
Executed in Both Run B Exclusive Aborted / Dormant