General
- Target 2026-10-01_4e124a6cedb1401eff0355d2d9fb92b4_elex_wannacry
- Size 911KB
- Sample261002-semqaacf26
- SHA256 5fb0e124aa181e88be21aeb17f411182b2ee4c9aa04940c24b3a5b3273e61ebd
- MD5 4e124a6cedb1401eff0355d2d9fb92b4
- SHA1 17149bfc5db7abd85f5c3c2cacf4f0be66efd699
- SHA512 e819cc94b966d0ee8eee922a5ff7b336a3ddd3266795c24d7f6356c0caf633cae4af8755183d7097a21bff2c54c0063bcc07e401613c0e1906fd47fe4b55b995
- SSDEEP 24576:VIhRHKfCGsZDCc2b2J26LgKKdFQkoT9SK+o:oRmCGsZDCcu2fLgRFD/K+o
- TLSH T1CB1523E58A90142BF539FF3584651B32E26F67D1CA42444F69D1EC7AD8B38B2D016BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-01_4e124a6cedb1401eff0355d2d9fb92b4_elex_wannacry.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-10-01_4e124a6cedb1401eff0355d2d9fb92b4_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target 2026-10-01_4e124a6cedb1401eff0355d2d9fb92b4_elex_wannacry
- Size 911KB
- SHA256 5fb0e124aa181e88be21aeb17f411182b2ee4c9aa04940c24b3a5b3273e61ebd
- MD5 4e124a6cedb1401eff0355d2d9fb92b4
- SHA1 17149bfc5db7abd85f5c3c2cacf4f0be66efd699
- SHA512 e819cc94b966d0ee8eee922a5ff7b336a3ddd3266795c24d7f6356c0caf633cae4af8755183d7097a21bff2c54c0063bcc07e401613c0e1906fd47fe4b55b995
- SSDEEP 24576:VIhRHKfCGsZDCc2b2J26LgKKdFQkoT9SK+o:oRmCGsZDCcu2fLgRFD/K+o
- TLSH T1CB1523E58A90142BF539FF3584651B32E26F67D1CA42444F69D1EC7AD8B38B2D016BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3