Analysis
- max time kernel
148s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 04:25
General
- Target 2026-10-13_d9d6d31234827940820c19f398f84fcc_elex_wannacry.exe
- Size 10.9MB
- Sample261014-e1257sv13n
- SHA256 9cf686b4d5fb8ba17b47ebfaa49861d87b8940dce360e8f61349aedfb6a494a6
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 39 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Runs .reg file with regedit 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_d9d6d31234827940820c19f398f84fcc_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d9d6d31234827940820c19f398f84fcc_elex_wannacry.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIUBI Partition Editor TE 9.9.8.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIUBI Partition Editor TE 9.9.8.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IQ69I.tmp\NIUBI Partition Editor TE 9.9.8.tmp"C:\Users\Admin\AppData\Local\Temp\is-IQ69I.tmp\NIUBI Partition Editor TE 9.9.8.tmp" /SL5="$90216,10851826,64512,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIUBI Partition Editor TE 9.9.8.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\settings.reg"4⤵
- Runs .reg file with regedit
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
npe.exe
unins000.exe
NIUBI Partition Editor TE 9.9.8.exe
ISTask.dll
VclStylesInno.dll
NIUBI Partition Editor TE 9.9.8.tmp
memory/836-11-0x0000000000400000-0x0000000000417000-memory.dmp
memory/836-220-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3080-95-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-93-0x0000000007930000-0x0000000007931000-memory.dmp
memory/3080-34-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-37-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-38-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-41-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-50-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-43-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-49-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-59-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-58-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-57-0x0000000007870000-0x0000000007871000-memory.dmp
memory/3080-56-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-55-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-54-0x0000000007860000-0x0000000007861000-memory.dmp
memory/3080-53-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-52-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-51-0x0000000007850000-0x0000000007851000-memory.dmp
memory/3080-48-0x0000000007840000-0x0000000007841000-memory.dmp
memory/3080-47-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-46-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-45-0x0000000007830000-0x0000000007831000-memory.dmp
memory/3080-42-0x0000000007820000-0x0000000007821000-memory.dmp
memory/3080-44-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-40-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-39-0x0000000007810000-0x0000000007811000-memory.dmp
memory/3080-36-0x0000000007800000-0x0000000007801000-memory.dmp
memory/3080-76-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-89-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-98-0x000000000752E000-0x000000000752F000-memory.dmp
memory/3080-17-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/3080-94-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-88-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-92-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-28-0x0000000007170000-0x0000000007186000-memory.dmp
memory/3080-90-0x0000000007920000-0x0000000007921000-memory.dmp
memory/3080-71-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-86-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-85-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-84-0x0000000007900000-0x0000000007901000-memory.dmp
memory/3080-83-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-82-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-81-0x00000000078F0000-0x00000000078F1000-memory.dmp
memory/3080-80-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-79-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-78-0x00000000078E0000-0x00000000078E1000-memory.dmp
memory/3080-77-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-74-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-72-0x00000000078C0000-0x00000000078C1000-memory.dmp
memory/3080-87-0x0000000007910000-0x0000000007911000-memory.dmp
memory/3080-68-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-70-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-69-0x00000000078B0000-0x00000000078B1000-memory.dmp
memory/3080-67-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-66-0x00000000078A0000-0x00000000078A1000-memory.dmp
memory/3080-65-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-64-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-63-0x0000000007890000-0x0000000007891000-memory.dmp
memory/3080-62-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-91-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-60-0x0000000007880000-0x0000000007881000-memory.dmp
memory/3080-75-0x00000000078D0000-0x00000000078D1000-memory.dmp
memory/3080-73-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-61-0x00000000076B0000-0x00000000077F0000-memory.dmp
memory/3080-99-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-100-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-101-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-102-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-103-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-104-0x0000000007390000-0x00000000076AA000-memory.dmp
memory/3080-201-0x00000000007B0000-0x00000000007B1000-memory.dmp