General
- Target 2026-10-01_619285e5662ca42bf66716ddb424d116_elex_wannacry
- Size 909KB
- Sample261002-qqtxmaxy8m
- SHA256 46533f05c054b91184ab407f7d97d18b5ab65820f3f2b8bece257cdc9f0ab34e
- MD5 619285e5662ca42bf66716ddb424d116
- SHA1 fb0255cc0d346e20ec77eb7994611d91715d3b19
- SHA512 0213e1e6a8c38ebf2fe365d9c17eab1f5b41ff73fe9b46ddd5f8aa1ad08e73bf6365cb0893e02ba2cc790c50c3059baea426ee9144cceee679388a1a4c608729
- SSDEEP 12288:1J/gnqf+yHba/vj9k+6UktMEYOY0cqpXQclhrTmshgfCWsmfCrs4Zh8y2qU9W67U:1tn+y7a/L9k+eYT0ckQemtfpyv8plMB
- TLSH T15A152355EDF461BDFB770034200DF23B69632C5C0A059E5F6F19CC962ABA261AF3B186
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-01_619285e5662ca42bf66716ddb424d116_elex_wannacry.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-10-01_619285e5662ca42bf66716ddb424d116_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target 2026-10-01_619285e5662ca42bf66716ddb424d116_elex_wannacry
- Size 909KB
- SHA256 46533f05c054b91184ab407f7d97d18b5ab65820f3f2b8bece257cdc9f0ab34e
- MD5 619285e5662ca42bf66716ddb424d116
- SHA1 fb0255cc0d346e20ec77eb7994611d91715d3b19
- SHA512 0213e1e6a8c38ebf2fe365d9c17eab1f5b41ff73fe9b46ddd5f8aa1ad08e73bf6365cb0893e02ba2cc790c50c3059baea426ee9144cceee679388a1a4c608729
- SSDEEP 12288:1J/gnqf+yHba/vj9k+6UktMEYOY0cqpXQclhrTmshgfCWsmfCrs4Zh8y2qU9W67U:1tn+y7a/L9k+eYT0ckQemtfpyv8plMB
- TLSH T15A152355EDF461BDFB770034200DF23B69632C5C0A059E5F6F19CC962ABA261AF3B186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3