Analysis
- max time kernel
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe
- Size 22.1MB
- Sample260821-dd92vs1fpc
- SHA256 13fac4d80387c3af3dc7ac698b67cad3278000b551b511457b1ba1efea25446d
- MD5 6da5aa20d70afc33ae78955c3fea761a
- SHA1 47e5bc59fc28b489a772e1fa36748d157429caaa
- SHA512 a35eb30250d9f5d85e8efa2de1db69faee16768f7cd77055028c00117f7120b653b89227bc1900319d5a047a319267eaf619c7f9dd69146ea241ec23e9ac1dff
- SSDEEP 393216:YiartXJnwhxAkmR31YaxMGQ4tbZJH4f+uLtauMnRKI8QCtxnl4dl:4RJPNR3V1Q4tPGORKnrtxy
- TLSH T1F53733D9D16FC253E11841BAFE8D95F6C9F02D66C98C5E7267E83E4A3217234BC48B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4604 QQ.exe - Executes dropped EXE 2 IoCs
pid Process 4604 QQ.exe 3528 QQ.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Z: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\T: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\R: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\P: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\D: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\B: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\W: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\V: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\U: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\K: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\G: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Y: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\X: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\Q: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\N: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\L: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\J: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\S: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\O: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\I: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe File opened (read-only) \??\H: 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5904 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 5904 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4604 QQ.exe Token: SeIncBasePriorityPrivilege 3528 QQ.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 4604 QQ.exe 3528 QQ.exe 3528 QQ.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5904 wrote to memory of 4604 5904 2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe 89 PID 4604 wrote to memory of 3528 4604 QQ.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_6da5aa20d70afc33ae78955c3fea761a_elex_wannacry.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\ProgramData\Tencent\QQDownload\QQ.exe"C:\ProgramData\Tencent\QQDownload\QQ.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\ProgramData\Tencent\QQDownload\ QQ.exe"C:\ProgramData\Tencent\QQDownload\ QQ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3528
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Tencent\QQDownloadRecordPath
- Size 260B
- SHA256 33291438b41219557b5d3a79b8d6f72ad1643c76130d8c7d524caa6102c5cd1c
- MD5 6b8240ba936401f2f5becad7aae4c408
- SHA1 74f5193b4777ad29ce6b7248955c3ee832037e4a
- SHA512 a2f80d1c407261c6ebcafa7972b440e25c31995c2cb68d400c6f666d14a3c7687bf85659f06756ae20d1a47eb36d37afe3fc3df076a51bb190a4f4e3e5496c34
- TLSH T1DDD0120045FFC571D8D0703789F6140DD2307D4919592F184B20880C698050DB8ED245
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Tencent\QQDownload\QQ.exe
- Size 27.1MB
- SHA256 5a2005e68d82312077baab38831fe1e75d89e01735f2dc2c3d586c7a4b59b9ff
- MD5 dc53d32043f9869681bf09433cb77ccb
- SHA1 b00481ba6e3531ab98ad4ad181695778b3c46fa8
- SHA512 68a850f168339a26f56a94a34ce38ff970dd8f2cc1f0f95ce8ef6b637e07a6fdb39ee74708fc178f9f5bc34fd0f07f1ab52969ef31e1dc1a1cf965a2e75ce391
- SSDEEP 393216:miartXJnwhxAkmR31YaxMGQ4tbZJH4f+uLtauMrFIN9oRKI8QCtxnl4d4:SRJPNR3V1Q4tPGOW9KKnrtxL
- TLSH T1C45733DAD269D223D228847AFECC65D5CCF16D97C98C6E7256F9394E320B2387D48B10
- MD5 SHA1 SHA512 SSDEEP TLSH