1960afc952ac59c691f93a0257752a4a89c1949076cd710b515bb3bd5d14e222

Analysis

max time kernel
13s
max time network
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
Size 57KB
Sample260828-ev281sep8v
SHA256 1960afc952ac59c691f93a0257752a4a89c1949076cd710b515bb3bd5d14e222
MD5 e002010d8384771ed11a5769ca10f873
SHA1 180484445452aff976c8f5489b5736ded3e4ac14
SHA512 e1de1d5f341e3379d7f3e5b2164f0e4ab154442075a4572a86baf828da2044c86225e5ce101002e3ce156a72bef7602803d71c98135bf0d758cffc287639a011
SSDEEP 1536:RhvGPxaCGTUtaNxngDsPtyY6SiomCEi1D:TUdInnVx6SiomCP1D
TLSH
T1F043D003ABD450B5FBA71A302CBA4D9AC5F6FE240645AF0B45D83ADD2C70910F94B79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/4116-0-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c581-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4116-10-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2844-15-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1804-16-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1464-17-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4460-22-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1464-25-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c583-23.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
1804	MSWDM.EXE
1464	MSWDM.EXE
4376	2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE
2844	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\devACC1.tmp	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	MSWDM.EXE
1464	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1804	4116	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe	89
PID 4116 wrote to memory of 1464	4116	2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe	90
PID 1464 wrote to memory of 4376	1464	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devACC1.tmp!C:\Users\Admin\AppData\Local\Temp\2026-08-27_e002010d8384771ed11a5769ca10f873_amadey_elex_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4376
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devACC1.tmp!C:\Users\Admin\AppData\Local\Temp\2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE!
    3⤵
    PID:4460

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_E002010D8384771ED11A5769CA10F873_AMADEY_ELEX_WANNACRY.EXE
Size 57KB
SHA256 c3daa1d77c1f41b7e5f3e94f2c47ad01cd89a9555b01f541fe60ae7b833f1ff5
MD5 82a511d7e2dcf066a5f4a34138a4a6c1
SHA1 488e2a1f61a94c44c57ecc8ef01aa1671ed06310
SHA512 63425d19cfcbf5178f8db76767e68475cc0641fe7c12d02fe1d8314f86d750085b04095a0328835460b0d910f7a8f8f878c088d3c6d4a246fa12f2d3b8c6644a
SSDEEP 1536:RhvGPxaCGTUtaNxngDsPtyY6SiomCEi1l:TUdInnVx6SiomCP1l
TLSH
T11B43D003ABD450B5FBA71A302CBA4D8AC5F6FE240641AF0B45D83ADD2C70910F94B79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 42KB
SHA256 d02fd6f7851d40f76e7c2451a8de69ccebdbd78b28a747b5b6948937fdb481d3
MD5 6ec2ce90e63a8734071176cc14930c68
SHA1 4dfc31d7bde277bd7f88bdd8d8efe176e0e2e3be
SHA512 1b0d598b8a814cf5f1cc9674e70993f09e0eae884c19c7ed60e22cf630f2fc319015de0fda88a05d077cb1438c41e4bd632f991a0cb9c30b9bfe98199d0d91b7
SSDEEP 768:13hvGPxwlCuC1d7GEFnI7S74stVOLNxngCNSgDcD1CtEHbY67jy:RhvGPxaCGTUtaNxngDsPtyY6S
TLSH
T17513F16B7384E5BACE0615360C7F4A9CC8DAEE695342668794CD2CEC3CC19303A4F49E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devACC1.tmp

Path C:\Windows\devACC1.tmp
Size 15KB
SHA256 24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088
MD5 b0cec9f342bf95700b602ee376446577
SHA1 b955b1b64280bb0ea873538029cf5ea44081501b
SHA512 05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e
SSDEEP 192:WN8CeeT+a2j12sUr/XKRbU+86HOO7+Bb2NpWP1oynJ+y7ihXar28d/o:xeT+a2jfUrfKRa6HiqpA13+y7+Xa1
TLSH
T15A62F7029FA804A1FBFB0B307EFA5D539576BD200964EF0E46707BAA5D70600E952767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-17-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1464-25-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1804-16-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2844-15-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4116-10-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4460-22-0x0000000000400000-0x0000000000417000-memory.dmp

Download