General
- Target 2026-07-02_09576dde51b032790305ea65fa246e60_elex_wannacry
- Size 404KB
- Sample260702-w2h76ab14w
- SHA256 73a9a991b73f00fa4f14f14f3500d01528ab4a68f2add08e34f219642a8564cf
- MD5 09576dde51b032790305ea65fa246e60
- SHA1 1c05bbd1cb1860b3d2aaec4881c8a19be907773f
- SHA512 1891f24ee07bc69854714d5e055f32cafae2902745eb3388ba57e84b4ed76a92e4a88279ee9780a02e1e31e6e8eb67d6defd1a799e9c21b5a1a8694be43f5358
- SSDEEP 3072:QoVDjW0L26YELGmoFpG9chfrwwghSjARhjymhwjlLEE+yTaLY9PIsz9/UaqYBwE4:Z+07LDoFQ9cdd6RlnwjlL6y7p
- TLSH T160948D4AB36DE169FE53247B985687E79FBE2EF13C4092547044770D0C7228EEE107AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_09576dde51b032790305ea65fa246e60_elex_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_09576dde51b032790305ea65fa246e60_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_09576dde51b032790305ea65fa246e60_elex_wannacry
- Size 404KB
- SHA256 73a9a991b73f00fa4f14f14f3500d01528ab4a68f2add08e34f219642a8564cf
- MD5 09576dde51b032790305ea65fa246e60
- SHA1 1c05bbd1cb1860b3d2aaec4881c8a19be907773f
- SHA512 1891f24ee07bc69854714d5e055f32cafae2902745eb3388ba57e84b4ed76a92e4a88279ee9780a02e1e31e6e8eb67d6defd1a799e9c21b5a1a8694be43f5358
- SSDEEP 3072:QoVDjW0L26YELGmoFpG9chfrwwghSjARhjymhwjlLEE+yTaLY9PIsz9/UaqYBwE4:Z+07LDoFQ9cdd6RlnwjlL6y7p
- TLSH T160948D4AB36DE169FE53247B985687E79FBE2EF13C4092547044770D0C7228EEE107AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.