Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe
- Size 94KB
- Sample260819-3ep6hsac23
- SHA256 65782d703192119947fd5bc10fa84ecdfc71dad022cc200e1ab4b2873a893d82
- MD5 037916d925c45ef6c06008e915dd0948
- SHA1 3471a91225aa100036d97b1db55cd987827ec499
- SHA512 6d3b9013d544e90e02fb1393f5b1e5be7615867d80f15e68e7c4ffcb4400e3b0fad52d3117e608ee9ac0b83762b9405f0c25d2de0ec32852c79775ca80b1de08
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auZ:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuZ
- TLSH T1F693ACFCAA2B2895E9D17D70D0176B5CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2708 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 2708 wmcserv.exe 5028 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe File created C:\Windows\SysWOW64\wmcserv.exe 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe 4976 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe 4976 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe 4976 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe 5028 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5028 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4976 wrote to memory of 2708 4976 2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-08-19_037916d925c45ef6c06008e915dd0948_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 a2caf673d82dc2bc53164c5db3449728d1c26c1f632809150b42eccbb1fb0d19
- MD5 22fed076dc9230e992018f9b22882e2a
- SHA1 aad7305067ec28e7fb522d5c53c475f0003def8b
- SHA512 ae8b4f1e060f18f60dedbf46b6748598a63f8434297da75da2b8eb744dcba0cf2195bd4a061536bef26af338acb8927ee1945fa2265e1a1cd3a4e45052354cbb
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auN:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuN
- TLSH T1BD93ACFCAA6B2894E9D57D70D0176B5CE5B87220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH