General
- Target 2026-06-30_92c12915321d38bfbdd7355712d3b9a6_elex_wannacry
- Size 404KB
- Sample260701-ecslvsfx2v
- SHA256 5d9adecfbd84d5eaf8599e66a128b08b3c425bf5a10aa2258b88e17e8cb1b410
- MD5 92c12915321d38bfbdd7355712d3b9a6
- SHA1 0d94fc570ce90a4ffdce2d7a3c89264b68ccd0be
- SHA512 1cc2a040249d50134e376d531f37213bd5f7c9c491b154169565d580aff23a1af4643afcffb41030dfd4dc5e1e692f3ca9d47a858cf16ff6053f56bdd04e9e71
- SSDEEP 3072:UoVDjW0LMqUFzcBywl33P8w4fsy11gNPbT0UbqALPmHPjvRf4sM6ZtbI59aqYBwt:d+0wqUFzcBnH+YNDLb/LuHrF4F6Ztu
- TLSH T19F946916B62DDD6BD6F290FD19559EE02B222F0D4D005A76E12C7F6D88363728E30F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_92c12915321d38bfbdd7355712d3b9a6_elex_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_92c12915321d38bfbdd7355712d3b9a6_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_92c12915321d38bfbdd7355712d3b9a6_elex_wannacry
- Size 404KB
- SHA256 5d9adecfbd84d5eaf8599e66a128b08b3c425bf5a10aa2258b88e17e8cb1b410
- MD5 92c12915321d38bfbdd7355712d3b9a6
- SHA1 0d94fc570ce90a4ffdce2d7a3c89264b68ccd0be
- SHA512 1cc2a040249d50134e376d531f37213bd5f7c9c491b154169565d580aff23a1af4643afcffb41030dfd4dc5e1e692f3ca9d47a858cf16ff6053f56bdd04e9e71
- SSDEEP 3072:UoVDjW0LMqUFzcBywl33P8w4fsy11gNPbT0UbqALPmHPjvRf4sM6ZtbI59aqYBwt:d+0wqUFzcBnH+YNDLb/LuHrF4F6Ztu
- TLSH T19F946916B62DDD6BD6F290FD19559EE02B222F0D4D005A76E12C7F6D88363728E30F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.