wannacry | 3fe7c7390088d4265a8d1042927fe19ed222e213df94d55b22f2efc4d1c2263d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Size 3.6MB
Sample260809-pm75ea1shy
SHA256 3fe7c7390088d4265a8d1042927fe19ed222e213df94d55b22f2efc4d1c2263d
MD5 b5d3f6ba902f0b75ad437fbc97dcd4e8
SHA1 1741d466bdffdc517b9682c1f7eeb9fa937183a7
SHA512 e1e348991e79d955894aaf4c0ddb3bbb28032073c51869c70f4a986545d71e636f79cb9d6122f86a4aa8087240e9ef70c245904baeebadd9b7352d17469c1fad
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9PoyWJgngx6MXYLQy8x:XDqPe1Cxcxk3ZAEUadot6MXN
TLSH
T15F06335E726D65FCD2061C7004A7C12AD6F73C690BFDAB09EBD055721E13E5ABBA0A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3317) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4352	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:532
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4352

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b5d3f6ba902f0b75ad437fbc97dcd4e8_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 a81e833773934217c1c112201729535cd44ac9895ec0b2d6ec08fb6609a6a0a4
MD5 c464e618cacedbdc95b5ae1c127fc4e8
SHA1 d14252dad01c4c462e76914a2057be476c7d1c4a
SHA512 b7cef3c6800290aae7e517a8363de1f29e1d6de48a18dc1f73ffabc3bf104e10511c475d75cdf10e40c445905e134a8cffdd6f10525b18e01cb9373934b08db4
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9PoyWJgngx6MXYLQy81:QqPe1Cxcxk3ZAEUadot6MXR
TLSH
T167F533AEB2773BFCE3061C74049AD12A95C628B65FDDBF14EBC114B21E14D6EEB90502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download