Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe
- Size 488KB
- Sample260717-vpcdeab191
- SHA256 c9baa7463767623075ac54213a8b033e2a1681519d0753a279fd36c4d8e05b61
- MD5 49a73bf1d4a6ff561d727f50020dc749
- SHA1 0d6c84a3473e690d1e2f347ed9d4b26f8ad6ae1e
- SHA512 043eef379cb26e699580bcf2860abf1a79aa5591e416e837182f88ac58ca88070eb821e1b84d1c81214849c118ff5298d5858eb7f52dfbf91269eb48d2a2731d
- SSDEEP 6144:HGkNeugsYW02QnZlmR75Yi2X3IQCn3fjA9VZFzUxXOdy/KkicWM+5nXwB:HGruf026ZlmR70Y/k9VS+LPMR
- TLSH T18CB4281639FCC73BE3D29530CE6CFB90B0F5B9684F21489736D4191C2A76986E316A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3616 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3616 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe Token: 35 3616 2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_49a73bf1d4a6ff561d727f50020dc749_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3616