56bba4d8eb78746971ae2c1fdf62c0b3c51134c0a2eb5669049881959123ac83

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
Size 108KB
Sample261024-gn455sf17x
SHA256 56bba4d8eb78746971ae2c1fdf62c0b3c51134c0a2eb5669049881959123ac83
MD5 874f452b94215267f1248689df9a51f0
SHA1 db5e938a7a57c7a3d607be56a93b0e4b65ff4267
SHA512 f6c983fb812ae38a451052943345ee638a5ae39d5efb5ab9e2d91012316d417b67362a56e98f8c7d408e9530bf12126f1b10cd9065b49b133eaf13cb17ba40c3
SSDEEP 1536:3wn9ieWn3NKTwrbsLO/h7KYwtF7NYYzJI0TMJUN1YDBSd0cIdw/GPrIzK+Ok:AnQ92wkMuYwtFuYzy018mICGrIGg
TLSH
T12FB3BE1ECA439813F0940C3487DB83F61FBDA827F5C3B66FFF11524A69A1259A890DB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
6080	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
6080	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
6080	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_874f452b94215267f1248689df9a51f0_elex_wannacry.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\gentee0E\guig.dll
Size 20KB
SHA256 96d1906ef8f1ac224830da79bc9492aa21ffbacd4caa4fb44cc64dedf09047a2
MD5 8757cd8c68b85d668f15befc13251d5e
SHA1 4ac9df9e507727072644e03815ab2f872e72fd89
SHA512 9a3286826d1ce780ce699dfd8d1244a94ce8700a89c75f2dbcfbae19e8609d243754067385364bdecb91e9108c11c062564e2d045652977faaf2e92d129b1a4a
SSDEEP 96:VT+uSqxZxbVbQU/2Fi0E8dc4UFaQfUkqd/k5X7Qncbl1/ifRxbSID1/Qw/g3A9h2:8QLDCEf44Lc0QnslJoRnD1/Qw/g3
TLSH
T17D92E87673D088F3D0CF16F00E522FAA67B5C420177578A34E234BDE5AE6504FD2AA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 904b926c5359a4058a80057cdc4bed4c0be43c2e1c8993e870cbab69831a84b4
MD5 ceb49a8552067f2b08c93aaa38da3d12
SHA1 7f4275ced86f448eb29f0b26cf5fe86fe43c783f
SHA512 d2a593bc04a3497b7cfbfd2a89add0dbf87f1e2fd159af9b44155cf3d35e16b3a4ae7ada194db94258385c5b9de49abb1e3ad8d26cbfc444d03798433e8e843d
SSDEEP 768:3EPbKk9022j0OfXs6ngzqk3pT3oMaOhnM+87EP3DnnUT+cDwGDl1a:3ETK+022j0F6SqMozOhnM+8oY9wal1
TLSH
T147535C03678640F6D6526A7A342F7276F734DFE702E6C6836F6DDC902D221A1A53A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6080-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/6080-16-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/6080-21-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads