Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe
- Size 94KB
- Sample260718-p2hhasfs7s
- SHA256 59a6f681c7882b76fae776c419df96cdbe69418c53422f3e3baf7a5eb31e9c2c
- MD5 239f28a54e3e6ee2e163e7ec372267b8
- SHA1 b7ae03803bc95aac55ef9e891bc4224d87c74e29
- SHA512 1c06325ef2af3cbe2a20b2d9399a8d3b6152ea667de9b934fc9c7cecaa8e8f3ed5fae0fc8a1f02414f467584eaf9d8e496231a66695159d1921d0da08b5d9c63
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auA:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuA
- TLSH T11993ACFCAA6B2894E9D17D70D0176B5CE5B87220D4663C28EFB17AA10B3F771902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 936 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 936 wmcserv.exe 2396 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe File created C:\Windows\SysWOW64\wmcserv.exe 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 484 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe 484 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe 484 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe 484 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe 2396 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2396 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 484 wrote to memory of 936 484 2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-07-18_239f28a54e3e6ee2e163e7ec372267b8_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 aac84930eed63402b349bf3bb09ae04590489fddfc3a053937e7a784c3f8bdf3
- MD5 9e767ab4a007ede142b8888f5e390819
- SHA1 e32939fc1c072359da1cb5992517b5a3e3735a60
- SHA512 70c3a2278a5068abf830be8a9da32f50f39e42c05206ed992989c7a63ec8d3d4574293b8d3fd7ebda36644bfe629640ebf125177c2d2dfe6bd289cd2dd6ce859
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3aua:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuua
- TLSH T1D093ACFCAA6B2894E9D17D70D0176B5CE5B87220D4663C28EFB17AA10B3F771902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH