155ef420c5dfc97a744a3a74a45b8ee4d912d5234ae299678e910cab58519150

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe
Size 76KB
Sample260821-eaebfsfr2z
SHA256 155ef420c5dfc97a744a3a74a45b8ee4d912d5234ae299678e910cab58519150
MD5 f454d18377f1b7bac2c9fb142a80b347
SHA1 2a877d188b63a01b6749233242ae349058f9abfe
SHA512 6dedaab29d0aaad7dba3a6b9bca90ca699adc26530d13c6184a83d416cd5cab272dd555fed6c110d6ce1283146b6ab7e94355c71cfe19b85c80522f38a8570c0
SSDEEP 1536:xmVbNKPIFHVc4pYqiFewA9HrMfV/ZXF1b44KEFXvxKqHs:xmNd/pLgg9HrMFxFtVXey
TLSH
T11D739EC1934D6785EC8A0470123BBF765929EE3CAD8F2673F396750B89B31C065B2A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1544	winhlps.exe
2756	winhlps.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\winhlps = "C:\\Users\\Admin\\AppData\\Roaming\\Locations\\winhlps.exe"	regedit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlps.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe

Runs regedit.exe 1 IoCs

pid	Process
5704	regedit.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2564	WINWORD.EXE
2564	WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 1544	5644	2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe	89
PID 5644 wrote to memory of 5704	5644	2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe	90
PID 5644 wrote to memory of 2564	5644	2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f454d18377f1b7bac2c9fb142a80b347_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Roaming\Locations\winhlps.exe
  C:\Users\Admin\AppData\Roaming\Locations\winhlps.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Users\Admin\AppData\Local\Temp\kb71271.log
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs regedit.exe
  PID:5704
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~DF4E74.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2564

C:\Users\Admin\AppData\Roaming\Locations\winhlps.exe
C:\Users\Admin\AppData\Roaming\Locations\winhlps.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDFE80.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kb71271.log

Path C:\Users\Admin\AppData\Local\Temp\kb71271.log
Size 153B
SHA256 33c4e8e847dd4ebc7ae1a77ac780f28a4b76d846a9f17f414d55c73e0f01f95a
MD5 808ba1eeddfe911890ddc1ef09d11b63
SHA1 865a52dacb1d65078b1791e3029a7bc814d81825
SHA512 40d31631315f981c41a566fd38ae8016bcb2d31673c97152f9a537e20f5d56362e57b3e94c68e9f2c0014795bdcdfb1133d97924d54737265805472e61ef9808
TLSH
T150C08CB5F406E72AB4D1266061351A859AF243ED30B6AB8A98041258280061C812A0EA
MD5 SHA1 SHA512 TLSH

Submit Download

~DF4E74.doc

Path C:\Users\Admin\AppData\Local\Temp\~DF4E74.doc
Size 36KB
SHA256 8fa73786d1cc884889040c7ee0c04582b3bc59a35a9a5f77c27eb40e322e091b
MD5 5594e30245eb62d802d5b992838bd370
SHA1 b0d61cbb4d30071ac9952a9c8d8efc4e4a880bac
SHA512 ca5fb7a1f7f2589c5bdbf8ed9b6fff54b4c37694acb84745d7ae0d4b9d6bb760fa4b46e5d2ed65af0febe0d26f67dcc9373a9473d1ec36138fbb194d883a2597
SSDEEP 384:ENo65ENrugR0I7y/4yGcSquRkxb2sxCy6EmwJQslBCHu:E4hR3yJuqbdxaslBCH
TLSH
T149F2B606A7E34F2DC07ACD78449A47AD193FAC194C76770BB09C772C2BB71A46B50B88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winhlps.exe

Path C:\Users\Admin\AppData\Roaming\Locations\winhlps.exe
Size 40KB
SHA256 c768687100f104645851a9d47db746dd32e72cbd47996babbe802dc24613fca1
MD5 3961319c6863c63b8a9d4166c95db1bb
SHA1 23e5cebcd4dcc54522f2a35d02d3c6c78dedb20a
SHA512 c6f24e7fcd0c3555db5ecdd692807bed9f89135e809cb207081a07487b53a4c0a971fe33490ed9f73806e2ab676544b0151ef6a3067dbc9e6147a29e6098fc48
SSDEEP 768:RwzvIM2F1EDeZV43h0dHmk0LLEQK7R/3kw1NBI8IZLnCm:RZL1Wy4wULLERBNBIl0
TLSH
T194135003A1BCB95BFDD81873221492972C512D349E9F50DBFFECD92791A92A97210B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 c81e42ebf7cfcf1c729fcb7bf08dd83fcd5edd2eabbb8db92bdcc52647bfa9d1
MD5 70b64a70aea7ceb31d1a41193efa2c3e
SHA1 784cfe9dfcf56f481ac131817cee6a355600669c
SHA512 72353ae56e164cb00c5b93efe57aceae59d92b85060e033235579e3c00a96a1415323e7bda83388f499fe55322cdd43b31d1027ce6f9cb42e4a00c077cf8add8
TLSH
T1B751DF0B97AF1F1BE08083B6562D875DCA71BC02E664975E9288813B7CE4A40CF5C767
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2564-27-0x00007FFB5A300000-0x00007FFB5A310000-memory.dmp

Download

memory/2564-25-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-26-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-24-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-28-0x00007FFB5A300000-0x00007FFB5A310000-memory.dmp

Download

memory/2564-23-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-22-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-190-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-189-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-187-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/2564-188-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads