4c57e561c19ddfc0cac63d1919f39975cc4782bc816c1f7f6337adc2bdd0dbd7

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe
Size 58KB
Sample260718-bd13vabs7k
SHA256 4c57e561c19ddfc0cac63d1919f39975cc4782bc816c1f7f6337adc2bdd0dbd7
MD5 64d7d27ed7c9df056c21ef1e9aa9af44
SHA1 40059da660899646d11473ed5e7bc6e50db4fb1e
SHA512 ad860ff2fe705c68d2bbc54c792231757df53cd3761fd39c41039b4d305ad6cf86763a5f455db58286584acd0c5a8bd45d2a83231a4c884d698f0fc227744673
SSDEEP 768:LhKENBPE7iJVuiL31PxUCmpJJEtN0ppqZDD9fUpwvdWUAohfjiT5edir:LhKENBnfblrmON0To9fUpwF0qfWT5Me
TLSH
T1C8431907ED8594F1E4210470146EB2BB96A71DA4865FFACAEF00EC5F6472394F83B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5148	nspfso.exe

Loads dropped DLL 1 IoCs

pid	Process
5148	nspfso.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nspfso.exe	2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe
File created	C:\Windows\SysWOW64\gei33.dll	nspfso.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nspfso.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2696	2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_64d7d27ed7c9df056c21ef1e9aa9af44_elex_scribble_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2696

C:\Windows\SysWOW64\nspfso.exe
C:\Windows\SysWOW64\nspfso.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gei33.dll

Path C:\Windows\SysWOW64\gei33.dll
Size 12KB
SHA256 3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5
MD5 de61de242b5500304af17e4661100ea5
SHA1 ed6c1fce0696ce100a93f2d3cea83a0475947e4f
SHA512 b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f
SSDEEP 192:Ch7fsivAwtj/3AdQYcOMh/U2MAiT5DdQQm9v+Y1v6vnYA:CdWwtjPAoh/3jiT5DdQpLiYA
TLSH
T1CA42F822271CC172C623013072EA51139BBD6939A0AF2D56DF579D0A2CBA2D1BD3BB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nspfso.exe

Path C:\Windows\SysWOW64\nspfso.exe
Size 58KB
SHA256 4c57e561c19ddfc0cac63d1919f39975cc4782bc816c1f7f6337adc2bdd0dbd7
MD5 64d7d27ed7c9df056c21ef1e9aa9af44
SHA1 40059da660899646d11473ed5e7bc6e50db4fb1e
SHA512 ad860ff2fe705c68d2bbc54c792231757df53cd3761fd39c41039b4d305ad6cf86763a5f455db58286584acd0c5a8bd45d2a83231a4c884d698f0fc227744673
SSDEEP 768:LhKENBPE7iJVuiL31PxUCmpJJEtN0ppqZDD9fUpwvdWUAohfjiT5edir:LhKENBnfblrmON0To9fUpwF0qfWT5Me
TLSH
T1C8431907ED8594F1E4210470146EB2BB96A71DA4865FFACAEF00EC5F6472394F83B14E
MD5 SHA1 SHA512 SSDEEP TLSH