wannacry | 22dcda497a5e93dbdf3e1f93a8eb7ee2c4c80ea7fbc45f9d88b9d4365a3beade

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Size 3.6MB
Sample260912-sxtasadh42
SHA256 22dcda497a5e93dbdf3e1f93a8eb7ee2c4c80ea7fbc45f9d88b9d4365a3beade
MD5 e9366805a20db775268ccc4592653be6
SHA1 faee483de3935db898b43e7de04feb0a38613285
SHA512 3180a42c9885cfcad3d7c77d818f078f868d1f041cb7acbbb520dd1b45f7d08e0abf60cadf5a0012e1fee6ad82eba9a23abfa8fd49a70671185107df5b356f19
SSDEEP 3072:QV+LydVaND9yFP3aILEVTCW5DgSglPcTcMXaDfldx0dFJtkoeV0XXQL:GE9l9y9qIYVTH5DgSg8ajldktM0XXa
TLSH
T11C06CF0A269C80F8C449A23498B74F29E7B7BC1E1639C64F1B64DB660F63391B578F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3361) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4832	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4620	4832	WerFault.exe	87
6116	4832	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasksche.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 4832	5512	2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5512
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 260
    3⤵
    - Program crash
    PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 264
    3⤵
    - Program crash
    PID:6116

C:\Users\Admin\AppData\Local\Temp\2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-12_e9366805a20db775268ccc4592653be6_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4832 -ip 4832
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4832 -ip 4832
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 54fadf51679fcacf06e4a259c4ebf7c873362c37d78cb5cbb4e7da64b0780b4e
MD5 e6beff6f1b9ba01a428a15fd360193c6
SHA1 0993f17614c73205ca33769fc135a02751e7970b
SHA512 a48eec8a2bc27972c60d6ac2531269ffc7de82005ba606b816c26be7cbf7ed8641f2a17dab60ba4f96a9863cd5ec72dcc8567a9b24631f54abdc9b0da9383ff4
SSDEEP 6:idquVg3F+X32wAqRtFigh6LAjBh+kv1OHii//MU1E+B:eVGSGwAqrFigOAikNFUBB
TLSH
T18AF52097EB5CB8B2E54C2170094FCC266AAA6574DBF141C60EF4002E78E177579F6E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download