0a7bd3ab356b510952c086509214b276293d9c464817adb67dd66f2e80cea83e

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe
Size 77.1MB
Sample260804-jhpvdathph
SHA256 0a7bd3ab356b510952c086509214b276293d9c464817adb67dd66f2e80cea83e
MD5 3af61a53ff019468b917677f3347be2a
SHA1 4902f4e680776293bc9bb41f84957d565dc5577e
SHA512 f7f69974df26e22325f566ed25584a568507bbba039d7c9b2274e95b0b2df38ca21936f2b0166346bf8f67fe1a2a915e44d5a0091ea37d70063a0aaaade447c1
SSDEEP 24576:ztZPErhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhj:+
TLSH
T1D8080204CB756EF39EB2F7358692346D22D5390B92038165C6F067AAD1A4FF23A1C46F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4260	Explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
4260	Explorer.exe
4548	explorer.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Lrmzjn Iux\Explorer.exe	2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Lymynm\30523	Explorer.exe
File opened for modification	C:\Program Files (x86)\Lymynm\2467	Explorer.exe
File opened for modification	C:\Program Files (x86)\Lymynm\Path.rcd	2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe
File created	C:\Program Files (x86)\Lrmzjn Iux\Explorer.exe	2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	Explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe
4260	Explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 4260	5856	2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe	88
PID 4260 wrote to memory of 4548	4260	Explorer.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3af61a53ff019468b917677f3347be2a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Program Files (x86)\Lrmzjn Iux\Explorer.exe
  FI
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Program Files (x86)\Lrmzjn Iux\explorer.exe
    explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30523

Path C:\Program Files (x86)\Lymynm\30523
Size 9KB
SHA256 2574d27c57db9c9eec5a156a5762d072a848466f1ee4799bd5796bc977394a35
MD5 718e87665b51fce0a29edc964396c7a1
SHA1 27335e147569d5a23263816f99bbcfb0091d4022
SHA512 46efbf4d641104bad8790635a7e9e9868a99b84d075b466682acb73cdb5fe2d1a0f200ccf97372b4b44be5372e4734fc7739cf9b162f70fd5e61cf61a58c7001
SSDEEP 192:dkyJqLZICn6zpi5hXV+5hXVIf+DyPSn/OTNny/qZNv:dxqLFJKJCf+WPS2JPv
TLSH
T1DA122365CB9BC68C80318611AE1EF1D5EAD37722D6D1B480D2F494BA1D60E3A9F24F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path.rcd

Path C:\Program Files (x86)\Lymynm\Path.rcd
Size 260B
SHA256 fd44d4ba8b76be0bf3c4d9a807aae554dbdba023e610756b5b61541ebc2c5fe1
MD5 9b717a329fab8917579500a6ab3bcd0e
SHA1 acb0088470f847d69c96427e8d4566d5df16dd09
SHA512 5548c64e7e78a151a6379a77d92e9cda18f6285793e9596ad0b94d923ab9128c0875fb38f6f992dbcec0baca2c8886e72f67d24b5338a2321be001d90ae6886f
TLSH
T1BED0128091BE8627EC00E0379AA0640990643C79AE192304C334998E2D80488B84860B
MD5 SHA1 SHA512 TLSH

Submit Download