Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe
- Size 94KB
- Sample260716-2e37psft3n
- SHA256 0ddb22001d6ec83c73200e8c1ddc9dfd5e3a22307cc95bf2940db1a92f56c4dd
- MD5 03ee59f5393c71df7bb5bee34e90e721
- SHA1 100f204af5eb9faf6051fc68f75d14bca2fc4a14
- SHA512 9090dcf9dcd52f38c2fd1f97e28a7842de22219f22719e3019e3ab49fd83a4acc9cd2dd3fc2309f69c47253a00d2efd954593b8f46d20dad9d413cbbd89003fe
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auT:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuT
- TLSH T10893ACFCAA6B2895E9D17D70D017AB5CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4952 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 4952 wmcserv.exe 776 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe File created C:\Windows\SysWOW64\wmcserv.exe 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe 2072 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe 2072 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe 2072 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe 776 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 776 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2072 wrote to memory of 4952 2072 2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-07-16_03ee59f5393c71df7bb5bee34e90e721_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 4577f8b71966a1f6773806af2bfc9e3f4eb5db93978df1d51175d52b8b0a7d27
- MD5 b5bf192c175d5e0ce5e8282065a42730
- SHA1 b3a5f60142126047b3eaa9a2407b58cc4b97d2b0
- SHA512 af5ba27352f4413e9234d8bf9deed22911f643faa285c235a54e1b2d7d5cc7e2be86173502d95972988bfb1364fd661040d0b757067e35d90ca8a64cd9f04fe6
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3au9:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuu9
- TLSH T1EF93ACFCAA6B2894E9D17D70D0176B5CE5B47220D4663C28EFB17AA10B3F771902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH