c24be5c42f90933018cdc528bbc6d463fdf0ee9cf6587b16a763d352b36ebe98

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe
Size 113KB
Sample260924-pd3tbsdf27
SHA256 c24be5c42f90933018cdc528bbc6d463fdf0ee9cf6587b16a763d352b36ebe98
MD5 26fa89c2d9611e366a38651fa040cf9f
SHA1 e18be3e559ae4ffb1da28e3cb4a36534d2eb6916
SHA512 6379f17799b6f2f2cf8d96c49f6b6bc9d165b6f4f0afcb73b17f61dd9d430e8540d4582defc1a10bc6e4737a2ba7c5b228a1a0b4e7c202e5fdb6a8c73d046fc0
SSDEEP 3072:NOfHIgb1k8IW1oQFs1ATbVqen+65la6lVaDlkK:IfHIgbtIKNFs1AXVJn+mIko
TLSH
T1C4B34826B6EC847BF4E231B12717FAB997B5E26006D18A0777980D037B66503E70F6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4804	2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5140	4804	2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe	88
PID 5140 wrote to memory of 4632	5140	cmd.exe	90
PID 5140 wrote to memory of 2780	5140	cmd.exe	91
PID 5140 wrote to memory of 2296	5140	cmd.exe	92
PID 5140 wrote to memory of 5340	5140	cmd.exe	93
PID 5140 wrote to memory of 5988	5140	cmd.exe	94
PID 5140 wrote to memory of 5344	5140	cmd.exe	95
PID 5140 wrote to memory of 2288	5140	cmd.exe	96
PID 5140 wrote to memory of 3008	5140	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_26fa89c2d9611e366a38651fa040cf9f_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ChangeIPv6.bat" disable"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $disable$enable$"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Windows\SysWOW64\find.exe
    find /C /I "$disable$"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "6\.0\."
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "6\.1\."
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2288
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "6\.2\."
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChangeIPv6.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ChangeIPv6.bat
Size 3KB
SHA256 b7580c5aa82676e6e935df43c94f96be4ae467d1f068e0e0d732d548580d40dd
MD5 65c010a7c0c7116f03abfd5c4d8e3033
SHA1 b380884f922f5ade841ae69bc0388bb6e0d64a3a
SHA512 76f014d5c928209c270af1ead05f022b761232718016aa54c4c2cd3795be62d0f2d4716ccf73e41ed81c0aa97fe149f16a9c37cc2854e9167e0577c169e9ef4c
TLSH
T16C71645933036E7D06F006255620C5D1D23A42CDC9626E38B0EB7FAC773D964027AE6C
MD5 SHA1 SHA512 TLSH

Submit Download