b63a6a749a47fa6f2e816433838146e5459d5f3f9a70621b22da3f11fa0f1ad5

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
Size 30.3MB
Sample260808-c1ghdsbb96
SHA256 b63a6a749a47fa6f2e816433838146e5459d5f3f9a70621b22da3f11fa0f1ad5
MD5 e2cf6471c8ec6db3e33aacecf5fca7b7
SHA1 cdd547fcfc4ff1f051392f8ddf77ebb4dbf4adb6
SHA512 811e9fdcc3e709c91242fb4f72baf3a8a5e2447275d345bb98adf896396d5437354e0440b6c731d47f10d0aeab64a3365110bfc462acc4c16e36a9f72dba9a43
SSDEEP 24576:F0Hp0zbLxjwOtYsssssssssssssssssssssssssssssssssssssssssssssssss0:W
TLSH
T1BF67D1CD057B11B48633A43177D210A5358146A596B0C92F8ADBEFE5F8CA4EF393A6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5964	Explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
5964	Explorer.exe
1924	explorer.exe
5892	Explorer.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\17370	Explorer.exe
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\11091	Explorer.exe
File opened for modification	C:\Program Files (x86)\Ufeczujuuu\Path.rcd	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
File created	C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	Explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5964	Explorer.exe
5964	Explorer.exe
5964	Explorer.exe
5964	Explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 5964	3164	2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe	89
PID 5964 wrote to memory of 1924	5964	Explorer.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2cf6471c8ec6db3e33aacecf5fca7b7_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
  .
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Program Files (x86)\Cymgvf Oabitvie\explorer.exe
    explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1924

C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
"C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorer.exe

Path C:\Program Files (x86)\Cymgvf Oabitvie\Explorer.exe
Size 41.6MB
SHA256 e561bf9b66385d5f557d392cac5ad2995d7c5db1bdb42df838ef5c73affcf9e3
MD5 d31e1043463dde7532bf3ef7158ae1ea
SHA1 3c7c8bbf79d43860ceab52a97ee1767084039aab
SHA512 e42226f18ad71274442025133cc4b47626193f2d61e7190ee39aec1e2dfde4999e095fd93fed63d9f2d480f32d2c3904e4e342add82a1aa90f0afeb6a8c72d05
SSDEEP 98304:Lcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccco:w
TLSH
T128A7E1CD443B12B481379436B7D624A03681C62485BCCA6F86D7EBE8F4DB9E736166C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17370

Path C:\Program Files (x86)\Ufeczujuuu\17370
Size 10KB
SHA256 9558cac8ba04f59f687106a4bd00acdcd2458f013f8240d5b86040999f86ccc3
MD5 5d8195fd596605c428784bf98628dc1b
SHA1 5505450d7b529e7426bd35d9e79de952124739d2
SHA512 a6bd3d20ebc0cec5c4a06873a66ec2a75a932cc9bb6835405bd8c1f61e59285855e3e80f96b868c5dad66f229b92bc8048da511ab891ae68928aab47ecbc6b00
SSDEEP 192:dkyiVL8rA2n6iWpi5hXV45hXVnTY+DyPSn/9JXnvYmq2bNWEt:d6VLOJ0J1TY+WPSlRQwxpt
TLSH
T1B8221361CB8BC68C803196115E2EF1D4EAD37721D6D1B480D2F495BA1D61E3E8F28F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path.rcd

Path C:\Program Files (x86)\Ufeczujuuu\Path.rcd
Size 260B
SHA256 4239c2f65f1b4b90afb1d9cc4b1d0c6e816bf18a536240e7b0710992e0c18db9
MD5 91489eb3d3f50d53972c328e923c53ab
SHA1 77ab10bd7c55e92e9fb68fee4781868c294fe730
SHA512 dbca297991c1b4ed764ad95f6c961deb10b86b3359928eac70b78e253a8a49743c826a0d74eded4c32673ad1fe3e4050960c7bc11b177f0d320a9fdd45214f6d
TLSH
T113D0121049BE4611DC2160778D611509E0B23A04DB356B608B50851775C144DF88A106
MD5 SHA1 SHA512 TLSH

Submit Download