87abf31b145edb0e924eb5be883436205e36a5a07eee41cfa9e88cd0980bc7ce

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
Size 34.4MB
Sample260703-zzdrfacv4m
SHA256 87abf31b145edb0e924eb5be883436205e36a5a07eee41cfa9e88cd0980bc7ce
MD5 51c293d70d15a35abff4953f5021544f
SHA1 52364612f13b12d118f0a1fa05ac01cf9f47cbf1
SHA512 9d3589704c64cf57a76fd43f9d8fffeb2c4a0194ecbe9583152e1a953c8639c97a8d9bebf43b470419d6a21d018df0c451ae7519e1b7a24ea8f3a9aed42e20ad
SSDEEP 3072:xowahJ0y5iDeT2mtTBf6NNFyxTXG93333333333333333333333333333333333V:QP5CeJtTB8FyxTW
TLSH
T18387D646CF692813F897BD02CAF378C27A4B6DF35B53E2B1139289C76261461B3A71C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/files/0x0011000000024393-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Deletes itself 1 IoCs

pid	Process
2052	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
2052	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3660	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
2052	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3660

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svmssc.exe

Path C:\Program Files\Microsoft Explorer\svmssc.exe
Size 49.2MB
SHA256 4601602ab5eb7cf3b8e97ae9340f1e4dff4e6bf649e00c104cc8136cd02d4e6d
MD5 54b3733b2244349ed1b63cc1aa218290
SHA1 1599d4d6843c088a315febcec416b2adacdd9722
SHA512 fed3cee16865a6cc98ddf1e3c2ef565fe58c710347422a844da155288f7c784c064d870d8123f74a62e06c2f0fca66c1cc4f2d22c364898cc8a76fd84619a286
SSDEEP 3072:xowahJ0y5iDeT2mtTBf6NNFyxTXG93333333333333333333333333333333333O:QP5CeJtTB8FyxT1
TLSH
T1A9B7F940DFF13C339996BC03CEF365C2B64B66E75FA3D97133A28497526106472AB298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp

Path C:\SystemTemp
Size 101B
SHA256 be18d57ebf339436f67aabbcb4322f7c0cf53b88877ddec8c1598880b59d4562
MD5 65b0ad8e21779a7e7c8d35f6f208f7ee
SHA1 afad4117e0f38c7d12dbfc667f6c61581ed4f6da
SHA512 56d298477cab918161fac1419f07a38b3656839b7c02852546d59947ed58a131077c841a9c6f6b6e93b9726813b0d7d279c9972b21fea8d2e05881d64505438f
TLSH
T14DB0120042F6A9C11C24551775B4114AF0A3790D2D6E174C8700DACC5248909FC983C0
MD5 SHA1 SHA512 TLSH