e0f98fe9974bf5e2bafffd6123745bdfa787a9e890ef0801361a63af1417f650

Analysis

max time kernel
65s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe
Size 84KB
Sample260707-s2vdmshs9m
SHA256 e0f98fe9974bf5e2bafffd6123745bdfa787a9e890ef0801361a63af1417f650
MD5 c852b5ce215d4a57bdc24bbbc3b4b994
SHA1 c0667910b22b8a548e08ee814276fba5dc948572
SHA512 64fca8bc963bcd596f9e854720032d5cbfdad07be269554d7d363a292201ba361799418d4610a8390fb17eff1dc4ff0cdc4b08269bdf19406a385ba729ae50cd
SSDEEP 384:rbLwOs8AHsc4sMfwhKQLro6m4/ClsrZ1eg:rvw9816vhKQLrod4/QQ
TLSH
T1F18319835BDD5CF2FB910131087D8BB9927B99D4950DBEDFAB50CE68403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2644	352057B91k3196q4fefi89A54ECF5941030E6k.exe
5652	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
1996	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
5840	300C2980Bk8424q4c96iB3E2447724079AEB2k.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
File created	C:\Windows\300C2980Bk8424q4c96iB3E2447724079AEB2k.exe	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
File created	C:\Windows\352057B91k3196q4fefi89A54ECF5941030E6k.exe	2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe
File created	C:\Windows\3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe	352057B91k3196q4fefi89A54ECF5941030E6k.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	300C2980Bk8424q4c96iB3E2447724079AEB2k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352057B91k3196q4fefi89A54ECF5941030E6k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3972	2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2644	352057B91k3196q4fefi89A54ECF5941030E6k.exe
Token: SeIncBasePriorityPrivilege	5652	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
Token: SeIncBasePriorityPrivilege	1996	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 2644	3972	2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe	88
PID 3972 wrote to memory of 624	3972	2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe	89
PID 2644 wrote to memory of 5652	2644	352057B91k3196q4fefi89A54ECF5941030E6k.exe	90
PID 2644 wrote to memory of 2412	2644	352057B91k3196q4fefi89A54ECF5941030E6k.exe	91
PID 5652 wrote to memory of 1996	5652	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe	93
PID 5652 wrote to memory of 3752	5652	3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe	94
PID 1996 wrote to memory of 5840	1996	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe	95
PID 1996 wrote to memory of 2136	1996	31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_c852b5ce215d4a57bdc24bbbc3b4b994_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\352057B91k3196q4fefi89A54ECF5941030E6k.exe
  C:\Windows\352057B91k3196q4fefi89A54ECF5941030E6k.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
    C:\Windows\3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
      C:\Windows\31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Windows\300C2980Bk8424q4c96iB3E2447724079AEB2k.exe
        
        C:\Windows\300C2980Bk8424q4c96iB3E2447724079AEB2k.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5840
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\31D9AB~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\3EA12C~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\352057~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:768
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:5868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2680

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

300C2980Bk8424q4c96iB3E2447724079AEB2k.exe

Path C:\Windows\300C2980Bk8424q4c96iB3E2447724079AEB2k.exe
Size 84KB
SHA256 57900f2307bf1985f2628838640b5ccc6a914c9c02a9c73cba5e494e4cc0ce1a
MD5 d31d175a99dc114391ccaf5872eceb71
SHA1 4da5ddbdf4f84c2773842a057cd1e3707cf5f3f0
SHA512 7b4d2f3cef55e4efa09f5451062d2dc1a241388947d74659704d3de651e81777fac0be2be699a15f538f8c288e2a352425242ef3d898b692b860cd4679042f16
SSDEEP 384:rbLwOs8AHsc4sMfwhKQLroO4/ClsrZ1eg:rvw9816vhKQLroO4/QQ
TLSH
T1A98319835BDD5CF2FB950131087D8BB9927B99D4950DBE9FAB50CE68403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe

Path C:\Windows\31D9ABCFFkAD6Cq417diBEA141969E6EF24C5k.exe
Size 84KB
SHA256 aaefef3c42dd6369d1e65aecd4df94657f7fc8c57dd92cb87e4fcfe7d60e58a5
MD5 e6d54ff6bb88b5dc2a525b47071f722b
SHA1 d8c1d97d9c0f02edd0fc532665a784e2794a927d
SHA512 bbffa08bb2be61f7a3777e4b3b54801d21d7ed82c4be245b14e1e77832b4d7efc0bb213f171fb0988858019d2d0af36d77fec21e04eab26329f21b8b2673075a
SSDEEP 384:rbLwOs8AHsc4sMfwhKQLros4/ClsrZ1eg:rvw9816vhKQLros4/QQ
TLSH
T165832A835BDD5CF2FB950131087C8BB9927B99D4550DBEDFAB50CE684037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

352057B91k3196q4fefi89A54ECF5941030E6k.exe

Path C:\Windows\352057B91k3196q4fefi89A54ECF5941030E6k.exe
Size 84KB
SHA256 a31e9e2c08086409a78fe4ee8048f467800780094634d2e931607df34363a612
MD5 95e752c6d392f310e5fc7f9a8eb72418
SHA1 090a4706b75a4809d5278aa783fd776f220edeec
SHA512 88eb3705280f20480a864f9ac79b54830981ece3ba428027bf166983aab186eb5a29af92989b97a2410494352d92b0c7fc7907f7380744afb37fff88a02b20cd
SSDEEP 384:rbLwOs8AHsc4sMfwhKQLroB4/ClsrZ1eg:rvw9816vhKQLroB4/QQ
TLSH
T1728319835BDD5CF2FB950130087C8BB9927B99D4550DBE9FAB50CE68403B292E43A10F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe

Path C:\Windows\3EA12C47DkC882q4140i9E8F4D3AA56908979k.exe
Size 84KB
SHA256 5c11190389e8c73f3d59aa41a609efe9921e467216fe04c1bb8b0e5cb2f7d179
MD5 88634f3cddb1ad6f3b04d71bcc4acee2
SHA1 e71a96271c732a4d1ee084ce1fa056edda08ee12
SHA512 93ed9fd513edacf1aec6907b19173ebb86d65589cd28aac25dc1ae8c94bbf28b591b926cbad8758db22292a64a6d86375a96e49ed55c03305f410e94f97bda8c
SSDEEP 384:rbLwOs8AHsc4sMfwhKQLro74/ClsrZ1eg:rvw9816vhKQLro74/QQ
TLSH
T16E8319835BDD9CF2FB950131087C9BB9D27B99D4550DBE9FAB50CD68403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-196-0x000002D5F7000000-0x000002D5F7691000-memory.dmp

Download

memory/1352-203-0x000002D5F7000000-0x000002D5F7691000-memory.dmp

Download

memory/1352-197-0x000002D5F7000000-0x000002D5F7691000-memory.dmp

Download

memory/2680-40-0x0000023382E70000-0x0000023382F70000-memory.dmp

Download

memory/2680-84-0x0000023396F80000-0x0000023396FA0000-memory.dmp

Download

memory/2680-56-0x0000023396AC0000-0x0000023396BC0000-memory.dmp

Download

memory/2680-55-0x0000023386560000-0x0000023386580000-memory.dmp

Download

memory/2680-70-0x0000023386A40000-0x0000023386A60000-memory.dmp

Download

memory/2680-38-0x0000023382E70000-0x0000023382F70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads