Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
- Size 22.1MB
- Sample260821-dd92vs1fpc
- SHA256 13fac4d80387c3af3dc7ac698b67cad3278000b551b511457b1ba1efea25446d
- MD5 6da5aa20d70afc33ae78955c3fea761a
- SHA1 47e5bc59fc28b489a772e1fa36748d157429caaa
- SHA512 a35eb30250d9f5d85e8efa2de1db69faee16768f7cd77055028c00117f7120b653b89227bc1900319d5a047a319267eaf619c7f9dd69146ea241ec23e9ac1dff
- SSDEEP 393216:YiartXJnwhxAkmR31YaxMGQ4tbZJH4f+uLtauMnRKI8QCtxnl4dl:4RJPNR3V1Q4tPGORKnrtxy
- TLSH T1F53733D9D16FC253E11841BAFE8D95F6C9F02D66C98C5E7267E83E4A3217234BC48B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2956 QQ.exe - Executes dropped EXE 2 IoCs
pid Process 2956 QQ.exe 1256 QQ.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\N: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\K: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\I: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Z: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\S: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\R: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Q: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\M: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\H: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\E: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\W: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\U: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\P: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\O: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\J: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\G: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\B: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Y: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\X: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\T: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\L: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3956 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 3956 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2956 QQ.exe Token: SeIncBasePriorityPrivilege 1256 QQ.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 2956 QQ.exe 1256 QQ.exe 1256 QQ.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3956 wrote to memory of 2956 3956 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 85 PID 2956 wrote to memory of 1256 2956 QQ.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\ProgramData\Tencent\QQDownload\QQ.exe"C:\ProgramData\Tencent\QQDownload\QQ.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\ProgramData\Tencent\QQDownload\ QQ.exe"C:\ProgramData\Tencent\QQDownload\ QQ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1256
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Tencent\QQDownloadRecordPath
- Size 260B
- SHA256 33291438b41219557b5d3a79b8d6f72ad1643c76130d8c7d524caa6102c5cd1c
- MD5 6b8240ba936401f2f5becad7aae4c408
- SHA1 74f5193b4777ad29ce6b7248955c3ee832037e4a
- SHA512 a2f80d1c407261c6ebcafa7972b440e25c31995c2cb68d400c6f666d14a3c7687bf85659f06756ae20d1a47eb36d37afe3fc3df076a51bb190a4f4e3e5496c34
- TLSH T1DDD0120045FFC571D8D0703789F6140DD2307D4919592F184B20880C698050DB8ED245
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Tencent\QQDownload\QQ.exe
- Size 28.1MB
- SHA256 a12b4b375bfa0f2c290fda3ee9737f0395403833220f816fccf6b57de3fbd7ec
- MD5 9439870628c11ad4dbbeb6a13d2a45ff
- SHA1 117eb4b904905ff190556fe49cf63131c0a59f61
- SHA512 bef7c755810a3820fa6fde7e9b172369e9ce4148179934e6698d415931f7d2a289d3fd71c9374c3fc78b8b31c3696214890d50b014f15a3b21cc00d8fd28be89
- SSDEEP 393216:4biCKg49HPBpT/x5dBSUKiartXJnwhxAkmR31YaxMGQ4tbZJH4f+uLtauMnRKI8/:n1H5pPdB8RJPNR3V1Q4tPGORKnrtxL
- TLSH T1BF5733D9D12EC753E11882BEBD9D66EEDAA05D41898CADB16BE87F067317334BC01B04
- MD5 SHA1 SHA512 SSDEEP TLSH