e7479ca264f6c7f1873cbba1eafd9b5a7d0d004656c4ea2244393f77144114fd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
Size 57.0MB
Sample260825-1w4dcseq5s
SHA256 e7479ca264f6c7f1873cbba1eafd9b5a7d0d004656c4ea2244393f77144114fd
MD5 c82ee04506eaafcfbffc7b06b5d3377f
SHA1 129c3a32618cc2d40535b9c5b24fbe8168de2595
SHA512 bedd8e76ce9af4c836e1970d32ab1a22b696ef20b91a088c592f7c8a93e1d8685e47292e0d07a5e7901c901dad532d706be64bee358e26a5ef470eb94c3dd2f2
SSDEEP 3072:MowahJ0yJiDeM2mtTBf6NNFyxXwMVQZARRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRP:nPJCestTB8FyxXpn
TLSH
T1A1D709192023BA4D80AB53DC15C03DAB47F2B6E58984C3E11C079A5B1FBF7674CF996A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2596	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
2596	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Explorer	2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3568	2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
2596	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_c82ee04506eaafcfbffc7b06b5d3377f_elex_gh0st_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3568

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemTemp

Path C:\SystemTemp
Size 101B
SHA256 cdcadf8f26c1fcddc27fcd2a4204c32c19573b707b3293990e8d9f4d7c14c5f3
MD5 8328796b1ddbc7bd78bb5729694594cc
SHA1 b6f61dbc687db87d6d25a602f90853c752c615e5
SHA512 f6f7aaf82742dd76df1a0b222bd125537d228c6b972c315dcdc33f9ec8356e92d41c70f34731d921285fa3a7cb2883a87caa547256adbbc7574ad9231371f87a
TLSH
T112B0120884FA86431809B01BFA700159E451380C5F7F57184B38D81874404C8BDC8244
MD5 SHA1 SHA512 TLSH

Submit Download