6fc41dae9f2fda7945b89e807ad3ba05b608f72f73142ad3b256d07464948540

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
Size 13.0MB
Sample261030-b93ljsda53
SHA256 6fc41dae9f2fda7945b89e807ad3ba05b608f72f73142ad3b256d07464948540
MD5 7591ee7777b9cb64c68d106104ef2275
SHA1 519e26a40dc093472fb8d37e9df4727ab4c09478
SHA512 c67671fedb29864756ad796b79c49112d9e3fa66e5fb95c9ef7caca8d2a1dbe286170f5391bb8b89e3e7f1dd593627df5c628cf69d0cf27ad575c2b2aba710d0
SSDEEP 393216:M9JklLQYrlYj6AtDQm47SKsnIjVBMfZNwyoz166Eu:mJk3rll9FGJmVmAA8
TLSH
T150D63341FFC259F1EE82457C419BAB3F6E26B6128731DDC3DB801511E8E3AD16A3829D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5300	2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
5300	2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
5300	2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
5300	2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Deutsch.ifl

Path C:\Users\Admin\AppData\Local\Temp\IF{2C9C00AC-6889-4678-872E-446C2002FCC2}\Deutsch.ifl
Size 3KB
SHA256 a792f4f5edee0e158798b75b82f6ac720e51957498450161b04ee812101f801c
MD5 981077ef92410cbf204c59e5465de5dd
SHA1 ad253930fd3a5edd8a81dc473f89132ff2243699
SHA512 3f1e30cd667a658f3a2f1388efbd712b57cc5b028de431fd995d8ff376734a8e7ec62a686502761c03214eded30b0ab445d0762b58e5d24663cd25ef8749725c
TLSH
T13B6150626EEAF36FE46F630D9241BDC2BB162554917FA214BCCCC01705073E8C6AE986
MD5 SHA1 SHA512 TLSH

Submit Download

licence.rtf

Path C:\Users\Admin\AppData\Local\Temp\IF{2C9C00AC-6889-4678-872E-446C2002FCC2}\licence.rtf
Size 320B
SHA256 1d46793c7b0dae86ebebad0a08e9c10e3ea72263cb18931c102407618e24c187
MD5 96c5cc55e66a870360254d666b335754
SHA1 f8c47fd4c5f019bd4ce48ac62ea8588ec689323b
SHA512 682df1ab3a68bafe2664dd81a9f3e71d3a7d9bc237c186396e3b4b2df0dc2004e1406bd6434596cbad15fef4b97199fff03f764d7cae99937e6a109d9c6ebbd7
TLSH
T1DDE07D714A84D1BA0B1CEB0CA661501B3B0D40B7BCD6B1E4B0027F4939A569C71E5CE5
MD5 SHA1 SHA512 TLSH