Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe
- Size 228KB
- Sample260922-yl3b7sec46
- SHA256 4b12488f74c6d29ad6d0b57fd273f9ed5d49699f2a05eec9406a677246f8756d
- MD5 6cd647feca736637206819315a599ca3
- SHA1 3e7d612d897145c967b3ac1386f3a433f1dae4fa
- SHA512 98ab1fa829e8602e0af245dd94cd2810ffabd8d900ebb1b49436fa866449c1b44d9a257ddf4dca7d0aca3d4111f0ff8a653ad4eb5c252d41f55bc5eb874e2757
- SSDEEP 3072:v2cb0l+qDzKAY8Jg0Qf4mPddTMHKv/D1eHkvhu+DVm8gV9c/vZ:e8s+EYJ0Q/diHKv/D1eHyu+DVg9c/v
- TLSH T1BC342A03A3E404E2F55110F1D9960BF6D27A82684D16F36A3BAC5A2C1EF1DC7F4B3968
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2304 Erexua.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe File opened for modification C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe File created C:\Windows\Erexua.exe 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe File created C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job Erexua.exe File opened for modification C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job Erexua.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Erexua.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main Erexua.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\International Erexua.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe 2304 Erexua.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2304 2612 2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_6cd647feca736637206819315a599ca3_elex_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\Erexua.exeC:\Windows\Erexua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
- Checks processor information in registry
PID:63424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Erexua.exe
- Size 228KB
- SHA256 4b12488f74c6d29ad6d0b57fd273f9ed5d49699f2a05eec9406a677246f8756d
- MD5 6cd647feca736637206819315a599ca3
- SHA1 3e7d612d897145c967b3ac1386f3a433f1dae4fa
- SHA512 98ab1fa829e8602e0af245dd94cd2810ffabd8d900ebb1b49436fa866449c1b44d9a257ddf4dca7d0aca3d4111f0ff8a653ad4eb5c252d41f55bc5eb874e2757
- SSDEEP 3072:v2cb0l+qDzKAY8Jg0Qf4mPddTMHKv/D1eHkvhu+DVm8gV9c/vZ:e8s+EYJ0Q/diHKv/D1eHyu+DVg9c/v
- TLSH T1BC342A03A3E404E2F55110F1D9960BF6D27A82684D16F36A3BAC5A2C1EF1DC7F4B3968
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
- Size 412B
- SHA256 fab3fd240b67f2192d78722f966a28bf1f0ac23839acacd1ebfe36b8875ffee1
- MD5 1d05c26712f8045fba08cd9a7028277c
- SHA1 b8c933676ceb7e5b96a9c2405bcbcae59449a6ee
- SHA512 d680ae01cb46bdfbcf0def34ea1b7cd7b020ccd677acd50236266e4bec622918f5c08af23e00ae2563821fd30f2b11e756acf5ca99ef3ef904aaa2d9343b2326
- TLSH T149E08C6E6AEAA420D3B7E6745DF1E2022B78F8A138515B0F11C91B495C13B41AE42629
- MD5 SHA1 SHA512 TLSH