Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 09:51
Behavioral task
behavioral1
Sample
2026-08-20_8e9a49f8eeea31c569332b032c46029a_elex_wannacry.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
General
- Target 2026-08-20_8e9a49f8eeea31c569332b032c46029a_elex_wannacry.exe
- Size 328KB
- Sample260820-lvvx9sxtet
- SHA256 29bf491173f67b227648afa825da4eea13fcc22be464311748de4e7abb2bb8dc
- MD5 8e9a49f8eeea31c569332b032c46029a
- SHA1 1555b295105b8eff144fdc85771baeed5897374f
- SHA512 f48f6d4c9ce7fc444e3c0ea385f300a3e3d9249cb9cb18d77d5a514bac687f9320513eb7be25e32b70b8f01f0f24bce84536dd2d045a2718a0e93ca28d282bba
- SSDEEP 1536:eyrRYWGfsas2QkFPIOgN30Mo4MnfsyoRrwLpEUub5cRX8lKCA9MmA+8vkqG/G:eyrRYWGfp/QkFPIOglo4Mf8+UR6x8cy
- TLSH T1AC643AEAE2245651D8F79B30F4175A224E76AE32C3DC51C7A935EE54EB720B0F9F2042
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/800-0-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/800-2-0x0000000000400000-0x0000000000452000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_8e9a49f8eeea31c569332b032c46029a_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3148 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3148 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_8e9a49f8eeea31c569332b032c46029a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8e9a49f8eeea31c569332b032c46029a_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
PID:800
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148