dad7e3eb2e9237a11dd86d4b8acee4039cc4b2bf2584fd9ad123cf5694979ba5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
Size 23.7MB
Sample260808-2nhx5azvcs
SHA256 dad7e3eb2e9237a11dd86d4b8acee4039cc4b2bf2584fd9ad123cf5694979ba5
MD5 a5fc9d3c8e88046673d35343e964df33
SHA1 6d49708becf23b2518825f38031d812ccb3e98c8
SHA512 f818aa9310762f00bc8a288cb44e690fda3158499cde0f73b32ef7454a35ceebfdf22b20d28714c167dab14adf44c48c221d60d15c25a92d6a281020577245ca
SSDEEP 49152:llT+iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiX:X
TLSH
T11E478653CF04DBD460EC36BAC945C1F8CA71C6067007FA559E5EAC29878D888EDDE8AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Deletes itself 1 IoCs

pid	Process
1420	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
1420	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer	2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4244	2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
1420	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a5fc9d3c8e88046673d35343e964df33_elex_gh0st_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4244

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svmssc.exe

Path C:\Program Files\Microsoft Explorer\svmssc.exe
Size 38.8MB
SHA256 312370f37090ad02e67e62d737e2449387858f2a6f214a1c1a510f69a5659aa3
MD5 cbc4d6fc8f2229b436eeeb3a43f9764c
SHA1 2d32f7c89e41fd38687311f9bd2f8c04e229f881
SHA512 26a26f73b1ff41026e69ef1a99fbad3358e800ea326870b03841349f9c7f674b215db22a473b911931c1497e40c1a3a61bf92fa107fd240f7cf73a39b9624cef
SSDEEP 49152:llT+iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii:i
TLSH
T17F97D857870C9B98289D3B68945052F8E5305326AC12E5B5CC0EEAA44FBDDCCEDBF847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTemp

Path C:\SystemTemp
Size 101B
SHA256 59c03348e65c28c58e540199e728ff44d56bd5969a2e8dde47e60e469cb36a77
MD5 3bd93d29f9c9ebdf5d8e8266a14aa1d6
SHA1 c13c5a4b59024eec018201749728146154c0714d
SHA512 2885d944619b93f0ede94a5ee6d96c254c91e639ff2ce9f4a674b7d1d87208cb6a8bf3ce242b02b262dd51779cc95e74701b63c7be2d25e5dd3d59d6a53a30b1
TLSH
T1A9B01240C2E586C13403D01BAD604589D0A4B40C7F6E13558710DB8CB8C041D7ED2943
MD5 SHA1 SHA512 TLSH