STAGE 3: DYNAMIC BEHAVIORAL TRIAGE
Dynamic Detonation Sandbox
Execute malware in an isolated FLARE-VM / REMnux sandbox. Trace live Procmon process trees, intercept Wireshark network streams, monitor filesystem/registry mutations, and isolate persistence vectors.
Sandbox Node
FLARE-Win10-x64
Host-Only 192.168.195.140
Gateway / DNS
REMnux INetSim Active
Sinkhole Gateway 192.168.195.1
Telemetry Hook
Sysmon + Procmon
Kernel Driver Intercept: ON
Risk Score
98 / 100 (MALICIOUS)
Ransomware
Detonation Timer
120.0s Execution Window
Isolated Snapshot Guard
Process Execution Hierarchy (Parent-Child Lineage)
Sysmon Event 1 (ProcessCreate)WannaCry.exePID: 3412PPID: 1420
Detonation & Killswitch Check
$ C:\Users\Victim\Desktop\WannaCry.exe
└─►tasksche.exePID: 3820PPID: 3412
Unpack Payload & Service Install
$ C:\Windows\tasksche.exe /i
└─►cmd.exePID: 4104PPID: 3820
Erase Restore Points
$ cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
└─►@WanaDecryptor@.exePID: 4628PPID: 3820
Display Ransomware Note
$ C:\Users\Victim\Desktop\@WanaDecryptor@.exe
Process Lifecycle & Resource Allocation Telemetry
| PID | Image | Integrity Level | Thread Count | Handles | Peak Working Set | Security Context |
|---|---|---|---|---|---|---|
| 3412 | WannaCry.exe | High / SYSTEM | 8 | 142 | 12.4 MB | NT AUTHORITY\SYSTEM |
| 3820 | tasksche.exe | Medium | 12 | 198 | 18.6 MB | NT AUTHORITY\SYSTEM |
| 4104 | cmd.exe | Medium | 16 | 254 | 24.8 MB | NT AUTHORITY\SYSTEM |
| 4628 | @WanaDecryptor@.exe | Medium | 20 | 310 | 31.0 MB | NT AUTHORITY\SYSTEM |