Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe
- Size 368KB
- Sample260812-acktssfl2s
- SHA256 a6cec2e8f47545481b4eb5823d520722e859aa71427c040c0cd41ec8da9745bd
- MD5 3de8f65b321cc3c09fa7f4619ea147bd
- SHA1 6d7b19bc7f89c14ffa33ef81f608ef047a3fe61e
- SHA512 d555559fdc000a39f6a7996cd3e761cf8e6602bf1276844efb27aab768bfd5c5fc09256a8b0193a317b88e3baeed2c8e6766a8a29501d22b43126d261a63cd02
- SSDEEP 6144:nN/183RtKvtdqsWt3Wvpavp/h3O3i8Hme3qW94r55uw/e:nt1IRtKvtdqsW4vYxp36IeaW94r5Uw
- TLSH T1148439D3DAAF80F4D9130C7808D95B7191B68CEE82085B63976CFF6085372B1B53A56B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe File opened (read-only) \??\F: 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2764 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe 2764 2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_3de8f65b321cc3c09fa7f4619ea147bd_elex_wannacry.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2764