4776ac717bd52ae040aca8f46a3b9e3800f76901e4fde59e07c102ab1eb721e5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe
Size 60KB
Sample260811-mxff2a1fkb
SHA256 4776ac717bd52ae040aca8f46a3b9e3800f76901e4fde59e07c102ab1eb721e5
MD5 4af72dc8efaed5512d3e1efa6e8e9137
SHA1 0e788dee179cb5c9b3886894d3e38f99c448fc7e
SHA512 d16128d5def4860f2ed438e566fc474e85fca59a540b7aa13ea7f1587bbb6e773859d15647d3b1add342eed126ba802924fc5b414b0adaaea503372a3c5d07a5
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrolw4/Clsrul:vvw9816vhKQLrolw4/QQ
TLSH
T1575319835BEE5CF2F7951131087C8BB9927B99D4950DBEDFAB40CD54403B292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5100	wB1A57603f1089v41092A69B851DA5E8EFB66l.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wB1A57603f1089v41092A69B851DA5E8EFB66l.exe	2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wB1A57603f1089v41092A69B851DA5E8EFB66l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4172	2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5100	4172	2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe	85
PID 4172 wrote to memory of 5096	4172	2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_4af72dc8efaed5512d3e1efa6e8e9137_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\wB1A57603f1089v41092A69B851DA5E8EFB66l.exe
  C:\Windows\wB1A57603f1089v41092A69B851DA5E8EFB66l.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wB1A57603f1089v41092A69B851DA5E8EFB66l.exe

Path C:\Windows\wB1A57603f1089v41092A69B851DA5E8EFB66l.exe
Size 60KB
SHA256 2ccb1dba9a47ea4e1fb603fbba4a046fe66c0f122bab258a5075bbcf66f02139
MD5 d32cda0d519faa9d8d6d02545b209bed
SHA1 1f625b3ee12e2c20aefa6479778d2f5234800dc5
SHA512 c92859285289bdf0ac7ffaa416bbda220b7c77ec7c96f31d95f21b835f0cc4426355c28a19a0107753de19d5a7bedd4a3a54f4bc0b19ac60d7cc348775ccd56a
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwy404/ClxyNhoyla/rl:vbLwOs8AHsc4sMfwhKQLroo4/Clsrul
TLSH
T10A5319835BEE5CF2F7911231087C8BB9927B99D4950DBEEFAB50CD544037292E93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download