Overview

overview

7

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

7

2026-08-16...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    126s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 10:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_a79ac8014ae5e49844885f1ab2e701b4_elex_wannacry.exe
  • Size 82KB
  • Sample260816-l92dlavfrc
  • SHA256 5a34a5fe89022b812d6a4c4e97cc33c0a17d3a807818e0905134242a099810da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 35 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a79ac8014ae5e49844885f1ab2e701b4_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_a79ac8014ae5e49844885f1ab2e701b4_elex_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Users\Admin\appdata\local\temp\winlgon.exe
      "C:\Users\Admin\appdata\local\temp\winlgon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:6008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 716
        3⤵
        • Program crash
        PID:1992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 724
        3⤵
        • Program crash
        PID:1972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 1272
      2⤵
      • Program crash
      PID:4436
  • \??\c:\users\admin\appdata\local\temp\winlgon.exe
    c:\users\admin\appdata\local\temp\winlgon.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 748
      2⤵
      • Program crash
      PID:2672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 756
      2⤵
      • Program crash
      PID:4764
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6008 -ip 6008
    1⤵
      PID:5440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 4856 -ip 4856
      1⤵
        PID:1792
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4632 -ip 4632
        1⤵
          PID:4828
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Windows\system32\compattelrunner.exe
            C:\Windows\system32\compattelrunner.exe -cv:Lae3Lig7O0yA+zmI.0.1 -wce:0000000000000208 -fullsync -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5964
          • C:\Windows\system32\compattelrunner.exe
            C:\Windows\system32\compattelrunner.exe -cv:Lae3Lig7O0yA+zmI.0.2 -wce:0000000000000208 -fullsync -m:devinv.dll -f:CreateDeviceInventory
            2⤵
            • Checks BIOS information in registry
            • Checks SCSI registry key(s)
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:3424
          • C:\Windows\system32\compattelrunner.exe
            C:\Windows\system32\compattelrunner.exe -cv:Lae3Lig7O0yA+zmI.0.3 -wce:0000000000000208 -fullsync -m:aeinv.dll -f:GetApplicationKBs
            2⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:5540
          • C:\Windows\system32\compattelrunner.exe
            C:\Windows\system32\compattelrunner.exe -cv:Lae3Lig7O0yA+zmI.0.4 -wce:0000000000000208 -fullsync -m:appraiser.dll -f:UpdateAvStatus
            2⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1196
          • C:\Windows\system32\compattelrunner.exe
            C:\Windows\system32\compattelrunner.exe -cv:Lae3Lig7O0yA+zmI.0.5 -wce:0000000000000204 -fullsync -m:appraiser.dll -f:DoScheduledTelemetryRun
            2⤵
            • Checks BIOS information in registry
            • Drops file in Windows directory
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4936
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
              3⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5536
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3840
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4500
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5180
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1936
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5920
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6008 -ip 6008
          1⤵
            PID:252
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4632 -ip 4632
            1⤵
              PID:4892

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  winlgon.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
                  • Size 82KB
                  • SHA256 66b5c99bd0e963d0437af93908822bf0f8f23ee42ecbf31f45381921e9c0f83e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_pynnbc1t.zl5.ps1
                  • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_pynnbc1t.zl5.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Appraiser_Data.ini
                  • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
                  • Size 150KB
                  • SHA256 35b9c1352e1d6c206f5063f1d7a7884d1bed9dc969c5ef8338a8247e212a251c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Appraiser_AlternateData.cab
                  • Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
                  • Size 1.9MB
                  • SHA256 3b51a53334a5b04992d8d17f95de964ccae7c9061e6465ee8a8cfb30346ed35e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  1243849133.pri
                  • Path C:\Windows\rescache\_merged\2118023660\1243849133.pri
                  • Size 2KB
                  • SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  724260326.pri
                  • Path C:\Windows\rescache\_merged\3906713228\724260326.pri
                  • Size 167KB
                  • SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  65920245.pri
                  • Path C:\Windows\rescache\_merged\4136552255\65920245.pri
                  • Size 6KB
                  • SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  1729263535.pri
                  • Path C:\Windows\rescache\_merged\4264460956\1729263535.pri
                  • Size 4KB
                  • SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 f46b9f48c1e9a612bf96e7efe7788ba5c5ff2953c780c7e717b1d8973e5c0378
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b3ff73e904f4d4e5900938d0534ad7459de001fc3dfcffd56bb1568f648dda91
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/4936-1168-0x00000133E9C10000-0x00000133E9C11000-memory.dmp
                  Download

                  memory/5536-1172-0x000001CD74080000-0x000001CD740A2000-memory.dmp
                  Download