Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
- Size 13.0MB
- Sample261030-b93ljsda53
- SHA256 6fc41dae9f2fda7945b89e807ad3ba05b608f72f73142ad3b256d07464948540
- MD5 7591ee7777b9cb64c68d106104ef2275
- SHA1 519e26a40dc093472fb8d37e9df4727ab4c09478
- SHA512 c67671fedb29864756ad796b79c49112d9e3fa66e5fb95c9ef7caca8d2a1dbe286170f5391bb8b89e3e7f1dd593627df5c628cf69d0cf27ad575c2b2aba710d0
- SSDEEP 393216:M9JklLQYrlYj6AtDQm47SKsnIjVBMfZNwyoz166Eu:mJk3rll9FGJmVmAA8
- TLSH T150D63341FFC259F1EE82457C419BAB3F6E26B6128731DDC3DB801511E8E3AD16A3829D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe 2360 2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7591ee7777b9cb64c68d106104ef2275_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IF{C638F998-669E-4CEC-B4F4-71F7951DF87C}\Deutsch.ifl
- Size 3KB
- SHA256 a792f4f5edee0e158798b75b82f6ac720e51957498450161b04ee812101f801c
- MD5 981077ef92410cbf204c59e5465de5dd
- SHA1 ad253930fd3a5edd8a81dc473f89132ff2243699
- SHA512 3f1e30cd667a658f3a2f1388efbd712b57cc5b028de431fd995d8ff376734a8e7ec62a686502761c03214eded30b0ab445d0762b58e5d24663cd25ef8749725c
- TLSH T13B6150626EEAF36FE46F630D9241BDC2BB162554917FA214BCCCC01705073E8C6AE986
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IF{C638F998-669E-4CEC-B4F4-71F7951DF87C}\licence.rtf
- Size 320B
- SHA256 1d46793c7b0dae86ebebad0a08e9c10e3ea72263cb18931c102407618e24c187
- MD5 96c5cc55e66a870360254d666b335754
- SHA1 f8c47fd4c5f019bd4ce48ac62ea8588ec689323b
- SHA512 682df1ab3a68bafe2664dd81a9f3e71d3a7d9bc237c186396e3b4b2df0dc2004e1406bd6434596cbad15fef4b97199fff03f764d7cae99937e6a109d9c6ebbd7
- TLSH T1DDE07D714A84D1BA0B1CEB0CA661501B3B0D40B7BCD6B1E4B0027F4939A569C71E5CE5
- MD5 SHA1 SHA512 TLSH