Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe
- Size 94KB
- Sample260802-ns6yvshr4x
- SHA256 2d889dffa346229a2483fa17dfb58df65fabc71dc9d00c43d01036d4a4a447ac
- MD5 555ee12579fef730f7b5afcb5cc626bb
- SHA1 f7eb825fb57cc253144c01989c6efa676e8ac7fc
- SHA512 627b8d6111bdc74c51350643e2b7a3210d09abfdd1faa8a4598f3a1ff38fa411fec2b7f3160e82f542b384d11689705642d38ff33e236e54b6e31c05b049dfbd
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auW:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuW
- TLSH T12493ACFCAA6B2895E9D17D70D0176B9CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 6092 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 6092 wmcserv.exe 2712 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe File created C:\Windows\SysWOW64\wmcserv.exe 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3904 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe 3904 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe 3904 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe 3904 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe 2712 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2712 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3904 wrote to memory of 6092 3904 2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-08-02_555ee12579fef730f7b5afcb5cc626bb_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6092
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 08ae4b9843461b6134ea84209442c7c3db15e98133a0a42bd60dc9179040ec0c
- MD5 7c39ecf0589fe801daf24f04682c3c19
- SHA1 f901ef0fbe450cdb344a8cf34861829fa433b004
- SHA512 3cd140a6777d7e36c4aa34fbeab753d75b7ac6b227597300112d9ccabe1c3f33b6cc5b1ee3f6a0c0631ffd86f99126286dd77883bf646c2d00ba5f40a7faa5d1
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3au/:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuu/
- TLSH T1B193ACFCAA6B2895E9D17D70D017AB5CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH