c8266ef15309ee08096c5a9df420eca5a41c0b4bb9b2152234f0cd07b734f561

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe
Size 19.1MB
Sample260527-vxtmnags31
SHA256 c8266ef15309ee08096c5a9df420eca5a41c0b4bb9b2152234f0cd07b734f561
MD5 ecd0fad0bf2ea0a12faefe0fc9be2f3b
SHA1 b883a05a54ea99ad86e4b7c6f02d4634b7168736
SHA512 b826fc478a46f43e10def893388adbd3ae64636bbf66a832cc9aa855e95d15d573a9189784f45f7db14929cb8e5417661e2a6f42d8964ae9f5e5d115e751d863
SSDEEP 393216:YsheDVPp6itYXy0RG8F34n+lfoGZmAT6sUNFVu8gd76g04c5lW5EtqX5JiG3ANsN:YshkVR6uYXyB85NTZTYkd294cPFaYMAc
TLSH
T1CC17332266F1C97EF6410072569EC3F67AF3FB150BA6880F6396B55A27F01B091391EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Fast Video Cutter Joiner\Desktop.ini	2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Fast Video Cutter Joiner\Desktop.ini	2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3732	2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_ecd0fad0bf2ea0a12faefe0fc9be2f3b_amadey_elex_wannacry.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads