Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/08/2026, 01:38
General
- Target 2026-08-21_9bc566c5603df717c81d80c6f8b63ca2_elex_wannacry.exe
- Size 58KB
- Sample260821-b2mkcsha47
- SHA256 79c650acd61e9ab7327ea421c8b2044fa7a02b87f348c370bf0f9166a113f7bb
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Runs regedit.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_9bc566c5603df717c81d80c6f8b63ca2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_9bc566c5603df717c81d80c6f8b63ca2_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Help\AutoUpdate.EXEC:\Users\Admin\AppData\Roaming\Help\AutoUpdate.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\kb71271.log2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Runs regedit.exe
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~$workp.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Help\AutoUpdate.EXEC:\Users\Admin\AppData\Roaming\Help\AutoUpdate.EXE1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kb71271.log
~$workp.doc
AutoUpdate.EXE
TM02851223[[fn=iso690]].xsl
memory/5916-29-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-33-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-25-0x00007FFF406BF000-0x00007FFF406C0000-memory.dmp
memory/5916-24-0x00007FFF006A0000-0x00007FFF006B0000-memory.dmp
memory/5916-28-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-27-0x00007FFF006A0000-0x00007FFF006B0000-memory.dmp
memory/5916-23-0x00007FFF006A0000-0x00007FFF006B0000-memory.dmp
memory/5916-30-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-32-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-26-0x00007FFF006A0000-0x00007FFF006B0000-memory.dmp
memory/5916-34-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-35-0x00007FFEFDD80000-0x00007FFEFDD90000-memory.dmp
memory/5916-36-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-31-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-38-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-37-0x00007FFEFDD80000-0x00007FFEFDD90000-memory.dmp
memory/5916-41-0x00007FFF40560000-0x00007FFF407C3000-memory.dmp
memory/5916-22-0x00007FFF006A0000-0x00007FFF006B0000-memory.dmp