Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 01:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe
Resource
win10v2004-20260130-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe
Resource
win11-20260130-en
4 signatures
150 seconds
General
- Target 2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe
- Size 240KB
- Sample260423-b2dbpafx41
- SHA256 9afb196b62b40aa1791a215b0320b0198e69aa6ffa74a6d0525c783c769697fe
- MD5 190c42df966b8b8f46a4184c94309236
- SHA1 8ad4b10f33168adf6dfdd3609db31a3029b6141a
- SHA512 430fff908c5d538c60816a1c97acc0e58bd36cd60eef7853f2a1bfcb3181ab6d2414e42991a7e5130127818d7deb6923a0d575e6ebd6d1630a2d3c446b3d1a69
- SSDEEP 1536:RWnrhanhNMHc3eirpVEf+awKuJxOzFuPLqmFkXFMxECGsZSBwHHtoHEo3A4g:Rmrhm1eigTgu+mmCeHFZxoHEo3m
- TLSH T1483493669DD3902DF3DB257C8100CB7CB8A76E1095721B3BB684F8EC2836BE4C96551E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" 2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3080 2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe 3080 2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_190c42df966b8b8f46a4184c94309236_elex_wannacry.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3080