Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
- Size 27.1MB
- Sample260814-e7znnafc44
- SHA256 d90b9d767de2870c9d4fc23a8450b4c4c2ec19e42afb2a19b22c823adf79c1f7
- MD5 47aed90b6a453ec8be67f890a83757c5
- SHA1 e86ccc018b397cabcc5002dab97a9c2cf1e13885
- SHA512 88c5c8a33bac52a3bd96b457411c31123f8cbfadd628d3315b0a4cf3bbc3e4a481fabc800e1fd3b764d58f5ac01af86ef5ff7192a780e9f90c6c9cc5e01e7401
- SSDEEP 786432:sOZEKLTW4s8dRJPVmv5Z3rTcCxUT88/2oq:yKLVFYfr28izq
- TLSH T16C57330C555CCAE9C38222BFDAF9C2957CC80D604A525E19FBE66FD7F8A7520B14CB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 3332 QQ.exe - Executes dropped EXE 2 IoCs
pid Process 3332 QQ.exe 5028 QQ.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\Y: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\V: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\U: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\N: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\L: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\K: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\H: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\W: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\S: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\Q: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\E: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\R: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\I: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\X: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\T: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\P: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\O: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\M: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\J: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\G: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\B: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 632 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 632 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3332 QQ.exe Token: SeIncBasePriorityPrivilege 5028 QQ.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 3332 QQ.exe 5028 QQ.exe 5028 QQ.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 632 wrote to memory of 3332 632 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 84 PID 3332 wrote to memory of 5028 3332 QQ.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632 -
C:\ProgramData\Tencent\QQDownload\QQ.exe"C:\ProgramData\Tencent\QQDownload\QQ.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\ProgramData\Tencent\QQDownload\ QQ.exe"C:\ProgramData\Tencent\QQDownload\ QQ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Tencent\QQDownloadRecordPath
- Size 260B
- SHA256 5d2d85f50e7107aaaa4560a8513234c2526804a25e8c4305923d5868f2343f56
- MD5 e21f656cb11451f8c6469e70ddeaf73e
- SHA1 0c439e5008029a02f55ceab11e39fbb23d426f10
- SHA512 1f1dc510eba0ad142feddf9c1bc1cf681391f4155f61a51afc3720a6941574e1d25422747c193694b763c1741589ee4b939ebce8522d0cbdc6c73f6f5f407d3a
- TLSH T1C0D0124044FDCA15FC05703749A2119C80A2BC071F8B77100391C8881DC255CB547105
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Tencent\QQDownload\QQ.exe
- Size 27.1MB
- SHA256 d90b9d767de2870c9d4fc23a8450b4c4c2ec19e42afb2a19b22c823adf79c1f7
- MD5 47aed90b6a453ec8be67f890a83757c5
- SHA1 e86ccc018b397cabcc5002dab97a9c2cf1e13885
- SHA512 88c5c8a33bac52a3bd96b457411c31123f8cbfadd628d3315b0a4cf3bbc3e4a481fabc800e1fd3b764d58f5ac01af86ef5ff7192a780e9f90c6c9cc5e01e7401
- SSDEEP 786432:sOZEKLTW4s8dRJPVmv5Z3rTcCxUT88/2oq:yKLVFYfr28izq
- TLSH T16C57330C555CCAE9C38222BFDAF9C2957CC80D604A525E19FBE66FD7F8A7520B14CB12
- MD5 SHA1 SHA512 SSDEEP TLSH