Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 14:56
Behavioral task
behavioral1
Sample
2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe
- Size 53KB
- Sample260608-sa2nmsgt5x
- SHA256 8fe09771eb7f947e8aacf2fd6ced9698d6d207def26c4ef5e40cfdc1e74838aa
- MD5 344962dcd23330704d67aa8c2f370bc0
- SHA1 79a14b46ad28c9a67d29b595337e9bd3c4d23f66
- SHA512 75debaf7de101251616501223983e1a2a0180e2803ee4047059ecc6a86bf07fc7fbad2a7e6c6a90841d9d9031a0efcdf165aeec2c18ee62ccff58c7cfe52dfbc
- SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrj8d:fETVqhp8AvGBFswzLKiWmJ8d
- TLSH T170334338AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects CryptoDef 1 IoCs
resource yara_rule behavioral2/files/0x002000000002b2a3-4.dat family_cryptodef - Executes dropped EXE 1 IoCs
pid Process 2984 eilgx.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eilgx.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4712 wrote to memory of 2984 4712 2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-08_344962dcd23330704d67aa8c2f370bc0_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\eilgx.exe"C:\Users\Admin\AppData\Local\Temp\eilgx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\eilgx.exe
- Size 53KB
- SHA256 76ce891c26a1420bdafa6f125d4e6d049277da735d6b11eea651d74b6c80626f
- MD5 bb9c21c8ddb0f9e636daa8ba579bff2f
- SHA1 b53cbed4a49f8cf6d20ae778ab7c422f54996417
- SHA512 0c02ca46008f2189a04f1c371709e49a2265733bc2c66c10d8ee50fe7fa04318e3c07081b1a3f2815a4e16d886cef9e53fefdc77d867b4e58e0bdc9c67375327
- SSDEEP 768:NHxbwCOVqhe+8YmcuwrvGBETGxtJH7jAKtzkyCzkKiWmpfrj8b:fETVqhp8AvGBFswzLKiWmJ8b
- TLSH T136434338AED51572F37BDE758AF651C7AA747C227902280F4086B3540C33F76AEA5A0D
- MD5 SHA1 SHA512 SSDEEP TLSH