Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 19:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe
- Size 1.3MB
- Sample260810-x3gldswemb
- SHA256 17d894c17b04984b6ffcc1b31926b39c42d315cd861c3adbf7f34bd941d529ac
- MD5 fa89dc6f1409a181e896daa5840756f1
- SHA1 31bba021743eb5b872be8924cb67c428ed4ac861
- SHA512 d8e34af2d4ade77ab6e88cc1e9dd4df88f788b7d9d747cd65955ab89f928030cfb61b1c20b9195cca47eba8a88364b5e6ec772de0080f2f27cb8a4570ea0f65c
- SSDEEP 24576:P+Hx0990M0t4pwKQtSaxIzcck2tT1kEKd1crC2GXGTJH7zq81mDseT2rRtRyCR5i:Pcx0Yr+pwKQtSzhT1SDc7w6JbO8oYrRq
- TLSH T1885533B28260D3F9CBAF087075DFAC50D6769A809B8877A35F150A1DD334A4CC65A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\7-Zip\Lang\lt.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\pl.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ug.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\da.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ga.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\is.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\yo.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\7zCon.sfx 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\History.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\ext.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\he.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ps.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\tr.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\bn.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\br.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\da.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\en.ttt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\hi.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\hy.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\kaa.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\pt-br.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\id.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ko.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ku.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\mk.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\pl.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\pt-br.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\pt.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sv.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\be.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\el.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ext.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\nn.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\License.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\readme.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\7z.exe 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\cy.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fur.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\kk.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\nn.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\yo.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\7zCon.sfx 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\mng2.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\7-zip.chm 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\hr.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ro.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\ta.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\az.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ca.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fy.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\7z.dll 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\7zG.exe 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\eo.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fa.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\is.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\sk.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Uninstall.exe 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\an.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ast.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\fr.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe File created C:\Program Files (x86)\7-Zip\Lang\fy.txt 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_fa89dc6f1409a181e896daa5840756f1_amadey_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4680