ea7874674bfc9eea0fce776ab05f2c23798be35fce620e271aca90a94abbc6bd

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe
Size 40.3MB
Sample260720-kzeleact9q
SHA256 ea7874674bfc9eea0fce776ab05f2c23798be35fce620e271aca90a94abbc6bd
MD5 b0020b2626e5812fd211f6e2188d8b9b
SHA1 5a199b596af02fedfa5821a4d15f71c519c29f42
SHA512 ae0252bce7c2b32ef0feb6c6d35861d6c6c311eee69cad17ffede4f3a66b63d6be6ebaeae497466797e867fa2e922409a3cf9f54819b02fecf8a50807033bf4b
SSDEEP 786432:J9jBQAuBq83s+9xiPn6VwS2IS5grCzJ4ilgDQdJS69MXk0QfGHOGT:JFNGn3sUiPn6g5gQJ0QdJSxXkhGT
TLSH
T1D79733987F5ACB56D2D412F4DA806874A8E49D6703BDC283D3848788FB2FDB5B935630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\DriverBooster\desktop.ini	2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe
File created	C:\Users\Admin\AppData\Local\Temp\DriverBooster\desktop.ini	2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6140	2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0020b2626e5812fd211f6e2188d8b9b_amadey_elex_wannacry.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcrt2015.png

Path C:\Users\Admin\AppData\Local\Temp\DriverBooster\App\Driver Booster\Icons\Apps\vcrt2015.png
Size 1KB
SHA256 ac4531a4b4fe3b34054eb33f2caabe2776be0ea5fc5056670c139caffd51b4f4
MD5 a364eb8919ad57f2278960cf6a062862
SHA1 dd7fa8dd5894960fa47e8c74e2acec034da803d3
SHA512 68e06dcbf244211caac4e386bc73856a7b4da97681e58de3470d6f1000abd336c2d13c84ee11e2bcda9a48afd176efc34f9567ef3bebd5577731956402ead96b
TLSH
T16A410809E4087D05E2ECB99636FD557AADB3084040FCE8D2B48FC0562F50A76B59E9CF
MD5 SHA1 SHA512 TLSH

Submit Download