wannacry | 767d7995ba2c68240f225cf93fcb88993e0ff9bf542c8abe4783b27073d44c81

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Size 5.0MB
Sample260816-mwkpcswtgy
SHA256 767d7995ba2c68240f225cf93fcb88993e0ff9bf542c8abe4783b27073d44c81
MD5 68e2998e6941900f7e62ec02e6f1d221
SHA1 08ecb06a55c9e8f46c9540898c384d0a09365aeb
SHA512 3e6cbb0194c4b341db1db43851ccb89915b1379d1b977116967444eb154a7e906d3384a4f431850a5ce245b7e019c295703ae7280198d7aa46a546a4215bd925
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:XDqPe1Cxcxk3ZAEUadz
TLSH
T1F9363368622CD6BCE10519B40473CA2AA7773C6566FF5A0F8B504DA73D13B5FBBC0A42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Executes dropped EXE 1 IoCs

pid	Process
3316	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1660
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3316

C:\Users\Admin\AppData\Local\Temp\2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-16_68e2998e6941900f7e62ec02e6f1d221_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 5a90e0ccfccf4dfde83997043febbabeb2d9a55cf4dcb8a12b7c070383d19559
MD5 ae4a06fc694a22299ac9b593cbd3abd0
SHA1 aafa818e01b4f5a4a54c38763ef9092abfddbe85
SHA512 a782270d4a803fdb5a4c8ba44a8cf0579139ba3684ac567ed14607350b17c21f3b5a2979351bdd7f12afef80252281a062dfc05dea064dd8b911233254cb7680
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593a:QqPe1Cxcxk3ZAEUadza
TLSH
T1B2F533B8A230FB6DF2461CF80462C56B26562DA1AADF6E1BD7900D973C04F6F9FC0581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download