Analysis
- max time kernel
148s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe
- Size 272KB
- Sample260712-nlmxeaax9t
- SHA256 32ca937a34d62d5928542ed36ed06b06affbdbaed28c24a6ca2c8ea249ed81a2
- MD5 d09294c5dad9d304c8826af11f58f692
- SHA1 d6fa445e62c6d674fcb980869e5d32816c9266b3
- SHA512 578d520e1eef70804e224306d27d4a8ceb20bceaa878d3d1c07112a8e0d3c3d0306247192caeed0a9d9a918b1ea236095004b44dbd2b7074302a704ed5f88a66
- SSDEEP 3072:gu1mz2DPCyqwdC7KvOF52BRRNPbdxXNwauk6tXcRl0dODjaY70Lq2ZUW2r0XaREs:AMDndYqvfNR/r0dkjtInlqWtJw
- TLSH T17744F1B2D6208C2EE492C5B046B547F5273AAC87747E9D2C8BB1FC9DD9B42C09D112BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/796-14-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat - Executes dropped EXE 2 IoCs
pid Process 4780 e594a8c.exe 796 WindowsUpdate.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini WindowsUpdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e594a8c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsUpdate.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WindowsUpdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 WindowsUpdate.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe 796 WindowsUpdate.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 796 WindowsUpdate.exe Token: SeIncBasePriorityPrivilege 796 WindowsUpdate.exe Token: 33 796 WindowsUpdate.exe Token: SeIncBasePriorityPrivilege 796 WindowsUpdate.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3872 rundll32.exe - Suspicious use of SetWindowsHookEx 49 IoCs
pid Process 5156 2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe 5156 2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe 4780 e594a8c.exe 4780 e594a8c.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5156 wrote to memory of 4780 5156 2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe 87 PID 4780 wrote to memory of 3872 4780 e594a8c.exe 88 PID 4780 wrote to memory of 796 4780 e594a8c.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Roaming\Microsoft\e594a8c.exe"C:\Users\Admin\AppData\Roaming\Microsoft\e594a8c.exe" dmedmedme "C:\Users\Admin\AppData\Local\Temp\2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shimgvw.dll,ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.jpg3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3872
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_d09294c5dad9d304c8826af11f58f692_elex_wannacry.jpg
- Size 146KB
- SHA256 9d62d994935eea2930c85499bc21dd8d0c64aa29243407de0a481b74205bf68a
- MD5 9b511d99bf030146edb4cdde852cede7
- SHA1 2cd9ebcfe1ced423d0de45b0f5a65d832f73bb4a
- SHA512 9bc16041f6ae17a12979e99bd12634f585964b30f1df8c4f049370ed38310a5d7d98e3309cdf8b8f36fa7efa312ae96a490556f4118c97fe1e445587a622cab1
- SSDEEP 3072:9mz2DPCyqwdC7KvOF52BRRNPbdxXNwauk6tXcRl0dOU:eMDndYqvfNR/r0dN
- TLSH T100E312E2C038AC650E3B247D1E7906A37D19ADEDBABC563849DD9C590E2D9D8F00B079
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
- Size 80KB
- SHA256 4672f444db944873df35d6bf290cbd20a0801f4191537e6cbdd19dead60744ee
- MD5 d42733e4348a7f187e69d8e860c6cf5d
- SHA1 63443e952a26ec251b9d507ae08b026259ac1643
- SHA512 2759fc94777c9df86b557064c8eb2a76d229f3cca41b29e16fb6a3de2baab4ec2181c8773a87ace047d34698575eb80da365766b471c4cc089c409c8c7c02859
- SSDEEP 768:B6qz7aTCVv70Bnx9C/77a3SCHUiyhHovYeLgU0xknFSUT/mRxLBJB41BjiQaj/1:BjaOVv70Lq2Z0BW21fBJBUXaR
- TLSH T117839D72E261CC2DF453C9F097E5E2E95BAEA58170389D9C8F73F99C69702C48D903A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\e594a8c.exe
- Size 272KB
- SHA256 32ca937a34d62d5928542ed36ed06b06affbdbaed28c24a6ca2c8ea249ed81a2
- MD5 d09294c5dad9d304c8826af11f58f692
- SHA1 d6fa445e62c6d674fcb980869e5d32816c9266b3
- SHA512 578d520e1eef70804e224306d27d4a8ceb20bceaa878d3d1c07112a8e0d3c3d0306247192caeed0a9d9a918b1ea236095004b44dbd2b7074302a704ed5f88a66
- SSDEEP 3072:gu1mz2DPCyqwdC7KvOF52BRRNPbdxXNwauk6tXcRl0dODjaY70Lq2ZUW2r0XaREs:AMDndYqvfNR/r0dkjtInlqWtJw
- TLSH T17744F1B2D6208C2EE492C5B046B547F5273AAC87747E9D2C8BB1FC9DD9B42C09D112BC
- MD5 SHA1 SHA512 SSDEEP TLSH