d4a265994a3efdf1273b46a3bf75ab48e951c1f2f4d2aa2d1160bb738fa52978

Analysis

max time kernel
15s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe
Size 20KB
Sample260821-e7mdbsshkd
SHA256 d4a265994a3efdf1273b46a3bf75ab48e951c1f2f4d2aa2d1160bb738fa52978
MD5 534783f5a601acceb3c20c93dd68e36b
SHA1 784e8d23de1900a694895908a3f0584ba655d6ec
SHA512 01a916817f3932bd43a083812531e2a5089e54d8e85a4c524fe3f0d6bd995ddad42728ed11c9f623742a95959fdeec1ba5d41eeb5a7dfd8fb685dc06281aebc6
SSDEEP 384:rJEUw1ps+tY9iY8N5VxKCps5IH9PnCm78c5pcICjvrJh9ans1yduQWRo/:ry1u+tciNZ/s5g78G1ArYOyIQWRo/
TLSH
T1F6924B23DF9700F2EE276C71008A2B775B6F61990F019B97DB50DD6A18337D1E92A146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\demon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe"	2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_534783f5a601acceb3c20c93dd68e36b_elex_wannacry.exe"
1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads