87abf31b145edb0e924eb5be883436205e36a5a07eee41cfa9e88cd0980bc7ce

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
Size 34.4MB
Sample260703-zzdrfacv4m
SHA256 87abf31b145edb0e924eb5be883436205e36a5a07eee41cfa9e88cd0980bc7ce
MD5 51c293d70d15a35abff4953f5021544f
SHA1 52364612f13b12d118f0a1fa05ac01cf9f47cbf1
SHA512 9d3589704c64cf57a76fd43f9d8fffeb2c4a0194ecbe9583152e1a953c8639c97a8d9bebf43b470419d6a21d018df0c451ae7519e1b7a24ea8f3a9aed42e20ad
SSDEEP 3072:xowahJ0y5iDeT2mtTBf6NNFyxTXG93333333333333333333333333333333333V:QP5CeJtTB8FyxTW
TLSH
T18387D646CF692813F897BD02CAF378C27A4B6DF35B53E2B1139289C76261461B3A71C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c616-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Deletes itself 1 IoCs

pid	Process
4220	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
4220	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Explorer	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6180	2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
4220	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_51c293d70d15a35abff4953f5021544f_elex_gh0st_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6180

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svmssc.exe

Path C:\Program Files\Microsoft Explorer\svmssc.exe
Size 49.3MB
SHA256 e9878fe1730e178e9a40560468aa2a0d52cea02026f433a9243c663d952aa440
MD5 9938f539beb4cb714ab8ea3e9b00eb17
SHA1 6035c0e68cc30df576babedc73d693728e879d3c
SHA512 01d81d260eb42b885e8c9e93986eb1a61ef58f392531ccecf912599dca155cf1ffc000b2678e95ddf98295690cd6c014e45404a73245debe26f902b92abf786c
SSDEEP 3072:xowahJ0y5iDeT2mtTBf6NNFyxTXG93333333333333333333333333333333333b:QP5CeJtTB8FyxTE
TLSH
T1CEB71949DB021C47BA5B7C0387F32886BE5B2EB73B52D7B5135218C7B154046BB8BAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp

Path C:\SystemTemp
Size 101B
SHA256 be18d57ebf339436f67aabbcb4322f7c0cf53b88877ddec8c1598880b59d4562
MD5 65b0ad8e21779a7e7c8d35f6f208f7ee
SHA1 afad4117e0f38c7d12dbfc667f6c61581ed4f6da
SHA512 56d298477cab918161fac1419f07a38b3656839b7c02852546d59947ed58a131077c841a9c6f6b6e93b9726813b0d7d279c9972b21fea8d2e05881d64505438f
TLSH
T14DB0120042F6A9C11C24551775B4114AF0A3790D2D6E174C8700DACC5248909FC983C0
MD5 SHA1 SHA512 TLSH