831f505f2cfe8969d7d384b03ecab921e19fc6aa2196c0ba0eefd2fe46c8f5ee

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
Size 42.8MB
Sample260824-tht47seb46
SHA256 831f505f2cfe8969d7d384b03ecab921e19fc6aa2196c0ba0eefd2fe46c8f5ee
MD5 1e32d5f69d0371513a20198e07862f5b
SHA1 38c1073b6551383318cea68c9fe4b1982308e52e
SHA512 9323a5cb276227c7f4e68139c3f0d78e83109d1ff1d60339d7bd3a0de522b580edb4276136474496068aec84bec19364805b4e2dd6d47a425dcae0ad16010985
SSDEEP 49152:llT+iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiil:l
TLSH
T19DA7FA5007883FA56D816DE435ACCE5594DCE44F463318653FC287B9A2A3ECEEE427E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2792	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
2792	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer	2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3504	2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
2792	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_1e32d5f69d0371513a20198e07862f5b_elex_gh0st_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3504

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp

Path C:\SystemTemp
Size 101B
SHA256 2ae038f2828ec79d784cbcd8c1651ad5f0ad67daf71688f77eaf2df614aa73be
MD5 086c684cb771c180963e03b64a026706
SHA1 d40d1fda3a2e0f4e02b4dcb58295ea020da0117a
SHA512 a281935a3a59de879dc7da50a7dbfb75426a399b5c33d007675f7cc8cd569cff921e72371e08e60656bbcb3ea20832f6779bd36a52684584e0e632cf61f93551
TLSH
T1C4B0120041F6CE5224C7E40FB5717018D0B2790C3D4B17482F0CC98D28894887AD3200
MD5 SHA1 SHA512 TLSH

Submit Download