Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 04:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe
- Size 56KB
- Sample260821-eyl17ssfrf
- SHA256 7b7bf276ed070faf980b2eff60756643deeffa1182ce99f4914d95b1cb7576ab
- MD5 7ebff1e2444f5591f6599267231eabd0
- SHA1 49bb0cd328acd4a960e81500126d3a696bc39155
- SHA512 b8223f1b9b15deab266e3008df6238692ac775414bea8e5edd4cc0ee9cbb230c778efe2ccc0575f6966719d4aad49bcf5b9cb5a9d7834873c5445744c4c0f93b
- SSDEEP 1536:l+QhwqtyLyICJsmU1tEIU1632A+YNGwo:lXwD0u92rYNGwo
- TLSH T1D2432D119A41D05FC4C101BFB8B662BACF34BDF5C3A0698FAB85ABD527191EC5E03687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3664 2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe 3664 2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7ebff1e2444f5591f6599267231eabd0_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3664