Overview

overview

6

Static

static

3

2026-10-22...ry.exe

windows10-2004-x64

6

2026-10-22...ry.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 03:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_9bba1a733c70fee414d8ca14d431aa7e_elex_wannacry.exe
  • Size 382KB
  • Sample261024-dshadsssdt
  • SHA256 fa0a8a8742926ac32acd88fd0dfd9f392ea65db2a208d0f9d118a71cf57895dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_9bba1a733c70fee414d8ca14d431aa7e_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9bba1a733c70fee414d8ca14d431aa7e_elex_wannacry.exe"
    1⤵
    • Enumerates connected drives
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:4424

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        20261024041714_1.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261024041714_1.a
        • Size 2KB
        • SHA256 ad0020dfc909997d587e26de0eb036eb5a0f909308f26b3110709b4258f2fdf9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041714_2.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261024041714_2.a
        • Size 3KB
        • SHA256 d757ec8c7d9dc7595b5927356b0a1625c818d47c5aff41f7ef7a1c33e46f6769
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041714_3.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261024041714_3.a
        • Size 391B
        • SHA256 ac733c63ef454e9c0cd94071fe32a87b81b4b813016a93b857152373b4a45696
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041719_4.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261024041719_4.a
        • Size 273B
        • SHA256 d230cb0c8071d98bc089128d4fc05d4168e7bb81dc9b913ff011bcfc08d1b20a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041719_00000029.s
        • Path C:\Users\Admin\AppData\Local\Temp\~B4D8\20261024041719_00000029.s
        • Size 45KB
        • SHA256 8c802636052a90b8a5a0e270c4459c26367e1acb760ecf703dc4c47bf162989a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        20261024041735_5.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041735_5.a
        • Size 2KB
        • SHA256 8260f0c7bf354cb53ca69cf924c0f23757f6e425f6aa47e01f8c0d831921bebd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041738_6.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041738_6.a
        • Size 2KB
        • SHA256 0c95d9cbeddcb2b004cf8dd37afd5af7d4f77eb1108746950a902ef164087b11
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041741_7.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041741_7.a
        • Size 2KB
        • SHA256 706d5a3fe038a5bcf8d4f1423221c42352dcb1bacbbb12ba294bf9db07a2d680
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041744_8.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041744_8.a
        • Size 2KB
        • SHA256 956ea40d9c7ac96c9e19f30dfdbab76a3eee4de6fff7bfa50831d999ba772b53
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041748_9.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041748_9.a
        • Size 2KB
        • SHA256 27d41cdfdd94e51e12b231dd1a0468154b0bede0127d6f76fd565abf355c3be7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041756_10.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041756_10.a
        • Size 2KB
        • SHA256 e80557e242b3d4b56e76c87b9d59d033b711ebea36f4c0f93579340bfe7a1071
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041800_11.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041800_11.a
        • Size 2KB
        • SHA256 fb5e07ca6ff7c6f7dc09330d91507eefa8a7abd93d6070b4fb41d051e30ee698
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041804_12.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041804_12.a
        • Size 2KB
        • SHA256 def4c844682ac0db10730e1351a91e3c449338fc5a673573fa8fa495e0fb0714
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041810_13.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041810_13.a
        • Size 2KB
        • SHA256 7dad6289626943e6e85914ddf1844a2580dcafdc10009fd9d38eb879ed337e97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041813_14.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041813_14.a
        • Size 3KB
        • SHA256 80445c8f19297eb4b2b182d8094e2f6085ce42860c918d952e7503f931e546f4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041817_15.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041817_15.a
        • Size 3KB
        • SHA256 fe5b17ee5271125e42f84e16a938c417bbb871a8927d096ccea841b3f72b2170
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041821_16.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041821_16.a
        • Size 3KB
        • SHA256 93fdb4c56dcd36fc591f3115d75cec98ea71b0410ed6e2eec3c45af66455a5dc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041824_17.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041824_17.a
        • Size 3KB
        • SHA256 4b83eb57b04fdf6e7135d13b2c8fe687f9f31f6ee755fc306b5f8f9a19c84ac9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041828_18.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041828_18.a
        • Size 3KB
        • SHA256 12e5a0a570c25cea7a9063fb053d10f4016ef61c7b49811f3bd60909dee2d268
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041831_19.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041831_19.a
        • Size 3KB
        • SHA256 2b24ddd624f060fd338e0a04a26615ae815f5a17dc8b1ca82f919af3e14ade9c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041834_20.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041834_20.a
        • Size 3KB
        • SHA256 0018a71d756e91ceb0d220d65b68467e9c7a08c62ed45c9ca550ab0bb4d812c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261024041837_21.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261024041837_21.a
        • Size 3KB
        • SHA256 9b6404d3ebf14f5dc588a218583cc2bcc09ddd6a758db4d410ad97840b0269cb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4424-0-0x0000000010000000-0x0000000010032000-memory.dmp
        Download