Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 18:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target 2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe
- Size 936KB
- Sample260924-xe2lnaydpf
- SHA256 c6c7b14d7dd6a347afe8a06f0d2befeb14bb3dd3ed224d4355f0952c8e995e9e
- MD5 e948bcdf793a9c4adf86b50b313ea73e
- SHA1 f71a9f989e3cfd073b25ee897b9178892d02bf62
- SHA512 e8f92245c989bae5181652736d3f9ef4e3b17f2cab18260c7264289cb2fc709d60070df9709d35892f43aadeb4e856bff1ca1d0d72127cd36a624b075e750f92
- SSDEEP 24576:nZe0p4Ek4niOkl/A04szE87JKTvmLESw9:ZeW4SkZP4sz9Mb
- TLSH T10E15E756F5788323D0B3D0B9C5D6BA9AFD3234455B308ACB024AD36C2E276D6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 256 2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 256 2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe Token: 35 256 2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_e948bcdf793a9c4adf86b50b313ea73e_amadey_vidar_wannacry.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:256