Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe
- Size 48KB
- Sample260719-dn6gesdv2s
- SHA256 514717ce1b02590451340ea924cd68ad60f5f41b512371fe71dce88d902812da
- MD5 8d766d996f760965908723542f12b80e
- SHA1 0aaeb16a239723a352e16a771e06fba152290dee
- SHA512 874d907146b1962e65ff761a477ca68739473886ce19330ddaa357df277a6f1534d915f29030664d68df87189d798a3c1291394f40ab8e271d3a838dc41c4202
- SSDEEP 384:vsJMU71gwnWTcnEtu8szqK1n7m++eVCESPw2DM9LzfWl1:vJU7lQcn7AK17m+LVCLPw2DM9+l
- TLSH T1CF233903665447B2C22B543830DB3FF76E684C6911C185D29BB3DEA85E4B276E83A70F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5564 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\sonatmor.dll 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\sonatmor.dll 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe File created C:\Windows\SysWOW64\layerpop.ini 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 5564 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe 816 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 5564 2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8d766d996f760965908723542f12b80e_elex_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\sonatmor.dll
- Size 32KB
- SHA256 70deb9331b7e1d380e06b8675fda61b7acde4551b87f2ea893bf815c35943ab1
- MD5 451dd6a653ed91c0a84953e014e5ba58
- SHA1 c9a1ccbcfda660c15737a657be2cf031c3482a1d
- SHA512 140170d881ee680a0cb6fb40b109587e67f3c28922992a2d9ad2ebe0604ae60d0ef7156e33992378a862a6ff14d2aee515c27abea4a0c6685e0807c043cc9c0b
- SSDEEP 384:DcnEtu8szqK1n7m++eVCESPw2DM9LzfWl:Dcn7AK17m+LVCLPw2DM9+l
- TLSH T1A3E2F703525587B1C32B643970DB3FFB29290D9910D156929BB3DE682E4B123E93BB4F
- MD5 SHA1 SHA512 SSDEEP TLSH