f0c2054e8f1ebecefe7d6eaed62f8f61f9ebeff4e34beb418d5690d9b0556412

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe
Size 36KB
Sample261022-1w4dcsat2k
SHA256 f0c2054e8f1ebecefe7d6eaed62f8f61f9ebeff4e34beb418d5690d9b0556412
MD5 703fc26151a09c8a417fee03f1a6c00f
SHA1 5fde9ad70e6eaabd5fada552fc0788de93d1d499
SHA512 d44432b31e5b1ea83409bd814f318105ffb13ed8e3241adc3da3191b6c8fe81b8af74c1fe9627b724cc867620d65a140d7ca87c35e251439ad4b19c09b89e989
SSDEEP 768:sX0mvrQFZiRigW3BeBPkgkqMptgYToDWzbvDs:sXBrCGigWxaOmiHrs
TLSH
T137F20A01E6C1D46EE0A300B15676D7FAE97ABEF212086213B3D85DA50AF56A5FF1120F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5424	svchost.exe
3504	svchost.exe
3296	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5708	5424	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 3504	5424	svchost.exe	90
PID 5424 wrote to memory of 3296	5424	svchost.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_703fc26151a09c8a417fee03f1a6c00f_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2384

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 428
  2⤵
  - Program crash
  PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5424 -ip 5424
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Windows\svchost.exe
Size 36KB
SHA256 f0c2054e8f1ebecefe7d6eaed62f8f61f9ebeff4e34beb418d5690d9b0556412
MD5 703fc26151a09c8a417fee03f1a6c00f
SHA1 5fde9ad70e6eaabd5fada552fc0788de93d1d499
SHA512 d44432b31e5b1ea83409bd814f318105ffb13ed8e3241adc3da3191b6c8fe81b8af74c1fe9627b724cc867620d65a140d7ca87c35e251439ad4b19c09b89e989
SSDEEP 768:sX0mvrQFZiRigW3BeBPkgkqMptgYToDWzbvDs:sXBrCGigWxaOmiHrs
TLSH
T137F20A01E6C1D46EE0A300B15676D7FAE97ABEF212086213B3D85DA50AF56A5FF1120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download