Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe
- Size 94KB
- Sample260720-thnmesht4x
- SHA256 6ff3736758cca0bb3ba4af14509ecc4031c5e3c75f441f0cfb4a062909385e2d
- MD5 3e7c8ab54da1959bc4e97ca843dd38d0
- SHA1 5ecf4673b864d573f0fe614213fa63d2b1ea0c87
- SHA512 e80c646ed2e604a7f957a6c33d31b6d688d268c4abb895e9be2072ee0af30fc9e3e3bd3e553c919b61acde12dafd2fb25742f32cdcee0de9dddffbf3c20f4da3
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auj:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuj
- TLSH T12593ACFCAA6B2894E9D57D70D0176B5CE5B87220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1100 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 1100 wmcserv.exe 2388 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmcserv.exe 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4492 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe 4492 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe 4492 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe 4492 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe 2388 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2388 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4492 wrote to memory of 1100 4492 2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-07-20_3e7c8ab54da1959bc4e97ca843dd38d0_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 7b19f8da4f0c419b7913c30e13e61da44925094a96bddcf7cec6238a7c869801
- MD5 0c9ffe3498826da2da76fa2962fb0346
- SHA1 f6ed415ec5b0e0f82138c0e8bd356683a4657b89
- SHA512 edd5caedf16b457674eccd0f7e2e8ee95b85c473055e06975b59bac1d517a69613945c3abf786d953ce92f929302addecd1e13c13ff9159e48af4673305b1cf4
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auY:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuY
- TLSH T15F93ACFCAA6B2894E9D17D70D0176B9CE5B47220D4663C28EFB17AA10B3F770902CE05
- MD5 SHA1 SHA512 SSDEEP TLSH