Analysis
- max time kernel
151s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe
- Size 27.1MB
- Sample260814-e7znnafc44
- SHA256 d90b9d767de2870c9d4fc23a8450b4c4c2ec19e42afb2a19b22c823adf79c1f7
- MD5 47aed90b6a453ec8be67f890a83757c5
- SHA1 e86ccc018b397cabcc5002dab97a9c2cf1e13885
- SHA512 88c5c8a33bac52a3bd96b457411c31123f8cbfadd628d3315b0a4cf3bbc3e4a481fabc800e1fd3b764d58f5ac01af86ef5ff7192a780e9f90c6c9cc5e01e7401
- SSDEEP 786432:sOZEKLTW4s8dRJPVmv5Z3rTcCxUT88/2oq:yKLVFYfr28izq
- TLSH T16C57330C555CCAE9C38222BFDAF9C2957CC80D604A525E19FBE66FD7F8A7520B14CB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5576 QQ.exe - Executes dropped EXE 2 IoCs
pid Process 5576 QQ.exe 2872 QQ.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\X: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\S: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\Q: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\M: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\K: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\I: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\G: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\B: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\Z: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\D: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\V: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\T: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\P: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\O: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\L: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\H: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\Y: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\W: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\U: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\R: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe File opened (read-only) \??\N: 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3896 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 3896 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5576 QQ.exe Token: SeIncBasePriorityPrivilege 2872 QQ.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 5576 QQ.exe 2872 QQ.exe 2872 QQ.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3896 wrote to memory of 5576 3896 2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe 90 PID 5576 wrote to memory of 2872 5576 QQ.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_47aed90b6a453ec8be67f890a83757c5_elex_wannacry.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\ProgramData\Tencent\QQDownload\QQ.exe"C:\ProgramData\Tencent\QQDownload\QQ.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\ProgramData\Tencent\QQDownload\ QQ.exe"C:\ProgramData\Tencent\QQDownload\ QQ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Tencent\QQDownloadRecordPath
- Size 260B
- SHA256 5d2d85f50e7107aaaa4560a8513234c2526804a25e8c4305923d5868f2343f56
- MD5 e21f656cb11451f8c6469e70ddeaf73e
- SHA1 0c439e5008029a02f55ceab11e39fbb23d426f10
- SHA512 1f1dc510eba0ad142feddf9c1bc1cf681391f4155f61a51afc3720a6941574e1d25422747c193694b763c1741589ee4b939ebce8522d0cbdc6c73f6f5f407d3a
- TLSH T1C0D0124044FDCA15FC05703749A2119C80A2BC071F8B77100391C8881DC255CB547105
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Tencent\QQDownload\QQ.exe
- Size 32.1MB
- SHA256 1f5a19a0cbdf94049bf84122aa706e016ed59048a6f2183a25b97e678782dbe9
- MD5 586632473996651c21f0594c49a34d63
- SHA1 a033fc82fd116d3a26d25bba237743eede6fc806
- SHA512 3c00313f6d5cc703b4af8c922f7520a04f64fd43d5cf6e7ffb00c3fc910f8992658a7c7773ae2884e3e88a42f23acd0cfddae5ae41822071f9ea613207fb09d1
- SSDEEP 786432:iOZEKLTW4s8dRJPXbeDEs5Omv5Z3rTcCxUT88/2o9:sKLVFrbeDEs5Lfr28iz9
- TLSH T1B577330D0A5CDAD9C24361BF9EFAC66978C80D304A125D69F7A7ABC2D993130F55CF22
- MD5 SHA1 SHA512 SSDEEP TLSH