General
- Target 2026-07-01_bfb11d24419460496cb923b90f2d6f29_elex_wannacry
- Size 384KB
- Sample260701-sa6mlagw4j
- SHA256 a1ad112fa578bd776e665dd16dfe64c65cead54930ae48c7b973a73b819905c6
- MD5 bfb11d24419460496cb923b90f2d6f29
- SHA1 e2c22f72ca48028f4e43dd88bd1fb56c5e0a921a
- SHA512 df612942212c2cbe0a2a109882a30b54a33acf918cb448a2afdaea96cfa5e4edacf1ce0a401c8f9d6c2f7fa5d6ab6232e3ed48eadfe2f8f808a719f5c4fa8da2
- SSDEEP 3072:n8C29gw/z4OgYV7GskRxo/80te6peZExMeJbLCKbbKGAnqRd2eAEIFzIudMmx0Jx:PwbVgQYRobtTmeJbRba8c9dzIudx0bFV
- TLSH T19A846A09B9A1F59CE5AC5633788B9AB22FA52C539C1D1FD52CD1FB2C1931E4E2908F43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_bfb11d24419460496cb923b90f2d6f29_elex_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_bfb11d24419460496cb923b90f2d6f29_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_bfb11d24419460496cb923b90f2d6f29_elex_wannacry
- Size 384KB
- SHA256 a1ad112fa578bd776e665dd16dfe64c65cead54930ae48c7b973a73b819905c6
- MD5 bfb11d24419460496cb923b90f2d6f29
- SHA1 e2c22f72ca48028f4e43dd88bd1fb56c5e0a921a
- SHA512 df612942212c2cbe0a2a109882a30b54a33acf918cb448a2afdaea96cfa5e4edacf1ce0a401c8f9d6c2f7fa5d6ab6232e3ed48eadfe2f8f808a719f5c4fa8da2
- SSDEEP 3072:n8C29gw/z4OgYV7GskRxo/80te6peZExMeJbLCKbbKGAnqRd2eAEIFzIudMmx0Jx:PwbVgQYRobtTmeJbRba8c9dzIudx0bFV
- TLSH T19A846A09B9A1F59CE5AC5633788B9AB22FA52C539C1D1FD52CD1FB2C1931E4E2908F43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.