Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe
- Size 94KB
- Sample260822-ttya1a1vbv
- SHA256 de6c9c6b5e87f78d29766c492b3f7478c3e43da5af65a5364fcd78e3f8dc5f1f
- MD5 3d2a6362852040f91a2d96eb3f9790e7
- SHA1 a4a6e9f024b212b70110366ac1c01b8d5aae07ac
- SHA512 dd38eafb7883e4650502c0336c07736080167215cf650c3f7506d3d1244b85eff1b6e08d411f8f23a273770a4ca97f5c06a2be1e8c9286311055b1fc7f8146fe
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3auF:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuuF
- TLSH T19993ACFCAA6B2895E9D17D70D017AB5CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 4896 wmcserv.exe - Executes dropped EXE 2 IoCs
pid Process 4896 wmcserv.exe 4964 wmcserv.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents wmcserv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmcserv.exe 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe File created C:\Windows\SysWOW64\wmcserv.exe 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmcserv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5892 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe 5892 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe 5892 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe 5892 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe 4964 wmcserv.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4964 wmcserv.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5892 wrote to memory of 4896 5892 2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\system32\wmcserv.exe -d "C:\Users\Admin\AppData\Local\Temp\2026-08-21_3d2a6362852040f91a2d96eb3f9790e7_elex_wannacry.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896
-
-
C:\Windows\SysWOW64\wmcserv.exeC:\Windows\SysWOW64\wmcserv.exe -v1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmcserv.exe
- Size 94KB
- SHA256 e323bc64f49425500a32cf6dfa3292ad4a8f1e87e43259b426139b162de23df5
- MD5 05f5e23b2f8b7b9a9fc299115dfdee3e
- SHA1 cf7d9979ce8db5232255821898875cde7c35ae71
- SHA512 eb143aef39c44c6f62917fce83e9887e3c404afca7fea9ec96744d4dc139f1e62be6c7fd544ba0b3a5f915a9de2bad36c8549f10fc46bd5539864a80e1a9d86e
- SSDEEP 1536:+z8erPJC9O8ziPaArrK6LOhKvgEVPiGmBgZgqGIL/plNgWjzRcBRMxjxT3au9:CPJN8zY9XXOcgqQyWqj7NgWj2B+pxuu9
- TLSH T1EB93ACFCAA6B2894E9D57D70D0176B5CE5B47220D4663C28EFB17AA10B3F770902DE05
- MD5 SHA1 SHA512 SSDEEP TLSH