Overview

overview

6

Static

static

3

2026-10-26...ry.exe

windows10-2004-x64

6

2026-10-26...ry.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 18:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_45ba994d19477056b21e65a20a01ef8e_elex_wannacry.exe
  • Size 384KB
  • Sample261027-xcpt3sec63
  • SHA256 9fef2e3aa80b38d82b1d0ac4a20f522daee3e53723dc8b60780c6b76b9456125
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_45ba994d19477056b21e65a20a01ef8e_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_45ba994d19477056b21e65a20a01ef8e_elex_wannacry.exe"
    1⤵
    • Enumerates connected drives
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:1216
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4196

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Destro
          • Path C:\ProgramData\Destro
          • Size 57B
          • SHA256 1719d3cd70af488f4df6e91429a89b3759a8fd24804573c4d79c92da7aa18805
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184351_1.a
          • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261027184351_1.a
          • Size 2KB
          • SHA256 171d5160d7da116c744041e8e41f29090ffbaddbb11685265345589f9c2800ee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184351_2.a
          • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261027184351_2.a
          • Size 3KB
          • SHA256 d68057b44010cd7c49f3f7b1baedd64ecf83d7879ff36fb00077ed4a9d22c594
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184351_3.a
          • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261027184351_3.a
          • Size 392B
          • SHA256 9a707ec18f97a4b7e332a5199693a9f1f44c0467de9636fe58611ddd70b12c5c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184356_4.a
          • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261027184356_4.a
          • Size 273B
          • SHA256 6ed158243ee0d2e3aa7f6417cdca1dbc127f17ff342dcb61464f780c20433ecf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184356_00000029.s
          • Path C:\Users\Admin\AppData\Local\Temp\~B4D8\20261027184356_00000029.s
          • Size 46KB
          • SHA256 7f5f2341ef068a9d1115faf9abf107cc79b0cfe4bad26730502d5e520c7d675d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          20261027184412_5.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184412_5.a
          • Size 2KB
          • SHA256 b283ab673dd3b108ba3bee868d381ffe34acd798814c347eddfe0ad4ddbbb508
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184415_6.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184415_6.a
          • Size 2KB
          • SHA256 dd8ac1ffd228c3c4eaefaee27baf78da10cec78f77ec4b0e0ca944a07a7c2201
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184418_7.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184418_7.a
          • Size 2KB
          • SHA256 1e585d67c95b23dc038b464d92d0b7fc2bdb9bb750ac437874ce67db71063158
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184422_8.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184422_8.a
          • Size 2KB
          • SHA256 1b5bba947fd03e9e71fa76736748e827968b3b0efa7051c40ae4ef69adeb8853
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184428_9.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184428_9.a
          • Size 2KB
          • SHA256 b6b49efae6ac44357f796f1f81f61930f3be1878acb11ed25e403de6335b7c64
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184434_10.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184434_10.a
          • Size 2KB
          • SHA256 b3d3cbb0153d353ed5f92916ec944b69b1db7ca305a5d84916bd52c2ddf096a2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184438_11.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184438_11.a
          • Size 2KB
          • SHA256 24fd972e7e131487911837cf7be30cb93a53fa0307f619609a15957971d1bf76
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184442_12.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184442_12.a
          • Size 2KB
          • SHA256 bd72e0d746b83bb71b511c047ad0c1a555cdb72891a2b66011d1faa28e21a719
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184448_13.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184448_13.a
          • Size 2KB
          • SHA256 a01aab30e7a2c08f690858b3fd7562a0d7d91775511a3f18b434007ead4f436e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184451_14.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184451_14.a
          • Size 3KB
          • SHA256 cafe1cd3926db3175030a4594b03267d0bbf2a112269493146b8c6497fce8daf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184455_15.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184455_15.a
          • Size 3KB
          • SHA256 eec56f5a055ca7d1883d20aa9b26b4f9fb1737401de3f605a1ef09f2eb571788
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184459_16.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184459_16.a
          • Size 3KB
          • SHA256 be3d25921bc6e68d3a4a72fa010e5d5441f56c5fabd6a9fc6a3ebf4a02a306c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184502_17.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184502_17.a
          • Size 3KB
          • SHA256 3f5a37ddb8a508f5a4b662601bdef4e0c91a9cf834484669802caaa8e1962bef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184505_18.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184505_18.a
          • Size 3KB
          • SHA256 91dc6bbc79057622f8eac537395c538e178036e0a4d49b69bea418a715b03502
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184509_19.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184509_19.a
          • Size 3KB
          • SHA256 57cbb87c0fb71f2565b74af570fa93dfe081f04ddf9e1cc5072265cea75abdbe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184512_20.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184512_20.a
          • Size 3KB
          • SHA256 ce9763a5d63175a43269d079066b1c0833d2297bf634a5e11b6404b2f87c5e90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20261027184515_21.a
          • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261027184515_21.a
          • Size 3KB
          • SHA256 d79837eae3096d3565965f7414b8bfa7f76656c76d051c141edec852f4181f04
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1216-0-0x0000000010000000-0x0000000010032000-memory.dmp
          Download