Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe
- Size 31KB
- Sample260819-mx374ahn6x
- SHA256 f69570454d5e219c023b7b150a924ce4a70e1ea4218296201436e526be3b9439
- MD5 cf9cfdc6ca002d1f0f6fa5bccb3a582d
- SHA1 317abd8b50d81dbac15cee98e9c46f08182a43bd
- SHA512 96ce7d4f4ee0a740a616f8cdb8cc9dbf73c3c72696f04940b6dfc7ad68e3a84084116ec39c6a1612cbdc0fa0fb218223c2daf75c8b9676ca986a5a9b9c253e78
- SSDEEP 384:E0NMcjDYTdcfOho2VEnO8tAomSjDpoKrMsd1cIuPbV9HwXTEaXUA77UCI/hTQef:lNMSDYTO92VMDpoBQVmwpEAECIZz
- TLSH T1C5E23B032EA40DA9F1B28B705514AB06CA76FE717CB0EA5F170045CA6E36753AA7D31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wininetd.log 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe File created C:\Windows\SysWOW64\windialup\2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry\2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe File created C:\Windows\SysWOW64\windialup\2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry\launch.ini 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe 1916 2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_cf9cfdc6ca002d1f0f6fa5bccb3a582d_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wininetd.log
- Size 3KB
- SHA256 7522e932a679515398d4feaf1e169a57be2fc2ae9bd59014e84544cbf52a5c03
- MD5 d737154a5b2071e760962df6b03b66da
- SHA1 dadbd9172d0f727edbb2f2d489a477e3c20d0bfb
- SHA512 a7ed1c069cf39d6f0dd73a465161848a93ad1db2befc49ce00e6cca82685d15a48a781ceafdd19fa022c067b5235f8e9321b9c6d36fee662824dffcc569e7894
- TLSH T10761E945F4323474EF412E2712719601668AF5BB9AC8EE8933CF31923B13F2A4C058EA
- MD5 SHA1 SHA512 TLSH