wannacry | 2c071380c850d29313a58acae3a97446d165ff04acecbf16f48a2496f07446c6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Size 3.6MB
Sample260731-m3wefaep7s
SHA256 2c071380c850d29313a58acae3a97446d165ff04acecbf16f48a2496f07446c6
MD5 d0c1f9399fa590ea12568404a06a84f4
SHA1 bddc434a766da1a938f1958dc8810bfccdde9be4
SHA512 c8af63849e1bb28b6cf03f5f96791782e9b7c50270e51f61aa9149bce8d60d67960817f21cdc6da379480a31815c6b2629edc77d66c6f940baa76ba62f18f8b2
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTTAARdhnvoAHI:yDqPoBhz1aRxcSUTAEdhvpHI
TLSH
T17B06330D707C92FCD14A0AB814A7CEA7B3F37C5965FA6A0F9B4086761C53B45AFA4702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2790) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1220	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5360
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1220

C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c1f9399fa590ea12568404a06a84f4_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 851074e41ae4b56a22a9244d32044b3278149cffab94670245c9e2cd28becf01
MD5 e93f1217bfc13d765b8a6835a1a29888
SHA1 1eb7b1ceeff16d0faaae1958e5f5273a337f6ee8
SHA512 860cfba39b4632895c0fe8e9e25d802156f94f76d1a9b920cb143d94d2d2d3dde674fffd42f89d068554191ee30ad8d7b927ca4b92345fccf4d44479517e8a1d
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTTAARdhnvoAHj:QqPoBhz1aRxcSUTAEdhvpHj
TLSH
T176F5334D7031A7BCE3860EBD24ABCED732C779A5B9EA3E179A400176AC51E4D8FC4185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download