Analysis
- max time kernel
151s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 04:31
General
- Target 2026-07-11_6f699b0b89bc87ca125c19fcf8de64d1_elex_wannacry.exe
- Size 78.1MB
- Sample260711-e5dy6sbw7l
- SHA256 03c59097a7b82538f1af4fafb99dc4a2d13376b0243dda8d7ca2034cc40f4c56
Malware Config
Signatures
- Detects executables manipulated with Fody 2 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6f699b0b89bc87ca125c19fcf8de64d1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6f699b0b89bc87ca125c19fcf8de64d1_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AMFTool.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AMFTool.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\AMFTool.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_727db6e208bc4eadbcc053cca9123fcd.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA57D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFB81C05FDC45AB846DF1EAAD6C435C.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AMFTool.exe"C:\Users\Admin\AppData\Local\Temp\AMFTool.exe" 25723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AMFTool.exe
AMFTool.exe.config
preloader_Vivo_6750_66_Y69.bin
preloader_hct6757_66_n_patched.bin
preloader_oppo6771_17331_.bin
preloader_oppo6771_18531__.bin
AMFTool.exe
RESA57D.tmp
CSCFB81C05FDC45AB846DF1EAAD6C435C.TMP
guardian_src_727db6e208bc4eadbcc053cca9123fcd.cs
memory/2572-1827-0x0000000009D00000-0x0000000009D92000-memory.dmp
memory/2572-1832-0x000000000AFC0000-0x000000000AFCA000-memory.dmp
memory/2572-1811-0x0000000000A30000-0x0000000003B60000-memory.dmp
memory/2572-1810-0x0000000073592000-0x0000000073593000-memory.dmp
memory/2572-1844-0x0000000011EE0000-0x0000000011EF8000-memory.dmp
memory/2572-1824-0x0000000009510000-0x0000000009ACA000-memory.dmp
memory/2572-1825-0x0000000073592000-0x0000000073593000-memory.dmp
memory/2572-1826-0x0000000073580000-0x0000000073D3C000-memory.dmp
memory/2572-1843-0x00000000147A0000-0x00000000147BE000-memory.dmp
memory/2572-1828-0x000000000EB00000-0x000000000FF08000-memory.dmp
memory/2572-1829-0x000000000A230000-0x000000000A7DE000-memory.dmp
memory/2572-1830-0x0000000009F50000-0x000000000A05A000-memory.dmp
memory/2572-1831-0x000000000A090000-0x000000000A1D0000-memory.dmp
memory/2572-1812-0x0000000073580000-0x0000000073D3C000-memory.dmp
memory/2572-1833-0x00000000117E0000-0x0000000011D0C000-memory.dmp
memory/2572-1834-0x000000000FF10000-0x000000001070E000-memory.dmp
memory/2572-1835-0x0000000010770000-0x0000000010832000-memory.dmp
memory/2572-1836-0x00000000117A0000-0x00000000117AA000-memory.dmp
memory/2572-1837-0x0000000014660000-0x0000000014688000-memory.dmp
memory/2572-1838-0x0000000014690000-0x0000000014698000-memory.dmp
memory/2572-1839-0x00000000146C0000-0x00000000146DA000-memory.dmp
memory/2572-1840-0x00000000146E0000-0x00000000146EA000-memory.dmp
memory/2572-1841-0x0000000014700000-0x0000000014708000-memory.dmp
memory/2572-1842-0x0000000014720000-0x000000001472A000-memory.dmp
memory/4500-1823-0x0000000000300000-0x0000000000308000-memory.dmp
memory/4632-0-0x0000000000400000-0x0000000000439000-memory.dmp