wannacry | f616d1c652fcc3ebb7c0435a7b7b73496fc2127f9989e0814a155bd990cebac6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Size 3.6MB
Sample260629-bddbsaaz7k
SHA256 f616d1c652fcc3ebb7c0435a7b7b73496fc2127f9989e0814a155bd990cebac6
MD5 fc66f0ef7a29dce39878bf74c31a5f53
SHA1 c17273626438151cc935294db0d556871616a5cf
SHA512 6d9996eada30fa6f13bcda99288752edb78f164431e5acb95ba499164c66c38f44f437b8a1fc0965f53fb5aec2fb83bc5334e7a8b12a9cfc3b8033ab81742554
SSDEEP 49152:HnCQqMSPbcBVqxJM0H93ei6Om3MOurnjRDyQnh++LzdHg:H9qPoB8xWa93z6Om3MOujtDZnhf/Bg
TLSH
T1C806CF638AC650EED51B34F1296B792FD1FDBA1490299B9FC28C1D075B80C31B79F286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3391) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3340	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1272
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3340

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc66f0ef7a29dce39878bf74c31a5f53_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 f699d125efa764ae08ac62d64c0654e2742e740aafa718cd39727d28381eae4b
MD5 57549386df29a392e0e0485bbee88ba6
SHA1 3b1b49474e77d9cc9117af9970a51c5ebfd37b04
SHA512 1431956cd0b5decae584ad836147e524e0ecffa564a6d0d3f9866d23b669b316828ccc22428b7665ec92d9e6d69254987db90f733a33c945e42086edd7007cbf
SSDEEP 49152:nQqMSPbcBVqxJM0H93ei6Om3MOurnjRDyQnh++LzdHQ:QqPoB8xWa93z6Om3MOujtDZnhf/BQ
TLSH
T1ECF5BF638AC651EED51B34F1292B756FD0EDBA1490299F9BC28C1D0B5B80C31B79F2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download