Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 12:14
Behavioral task
behavioral1
Sample
2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe
- Size 77KB
- Sample261101-petbaaav61
- SHA256 6dd78e937a304bca6232aff806d53de34984df48157849a2e81052b6acbc5223
- MD5 866a7afaae4bd9cdb6e55422703f4af1
- SHA1 4d60e2e01710fa58387c5e068f5668007b61c9d8
- SHA512 4044a6b7e382bab0dcd515ca2c530d46fef6a68ea9d437e84680226e1627da124e541f2133a53a439def07984bda7cc8edf1222ad2a34cd42a5482a1d9503365
- SSDEEP 1536:xkT9lcP14n5qsVsIEVfELAlHa6K0mrdkT9lcP1LOQt4KWZkrMaHqaNSV0:xwcPu9Vv08LewxwcPZOQt4KWZkrM3aN5
- TLSH T1E1739F0BF680C8B3E27505F85D2981A6BD3ABE306D98461B7EB81F4DDD752C28E0D257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 13 IoCs
resource yara_rule behavioral2/files/0x000b00000001b2cb-5.dat family_fesber behavioral2/files/0x000d00000001c4f4-16.dat family_fesber behavioral2/memory/4656-13-0x0000000000400000-0x000000000041F000-memory.dmp family_fesber behavioral2/memory/2752-810-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1276-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1277-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1278-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1279-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1280-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1281-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1283-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1285-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2752-1287-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240755187.exe - Executes dropped EXE 2 IoCs
pid Process 2752 tmp240755187.exe 3620 tmp240755218.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240755187.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240755187.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240755187.exe -
resource yara_rule behavioral2/memory/4656-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000d00000001c4f4-16.dat upx behavioral2/memory/4656-13-0x0000000000400000-0x000000000041F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE tmp240755187.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3CAFD4F9-DEB7-48AE-AEB3-6A02434E32DF}\MicrosoftEdge_X64_139.0.3405.125.exe tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- tmp240755187.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- tmp240755187.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- tmp240755187.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- tmp240755187.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- tmp240755187.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe tmp240755187.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- tmp240755187.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- tmp240755187.exe File created C:\Program Files\Mozilla Firefox\firefox.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE tmp240755187.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- tmp240755187.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- tmp240755187.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe tmp240755187.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- tmp240755187.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe tmp240755187.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe tmp240755187.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- tmp240755187.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe tmp240755187.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe tmp240755187.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- tmp240755187.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tmp240755187.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tmp240755187.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240755187.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240755218.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid 4 4 4 4 - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2752 4656 2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe 89 PID 4656 wrote to memory of 3620 4656 2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_866a7afaae4bd9cdb6e55422703f4af1_amadey_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\tmp240755187.exeC:\Users\Admin\AppData\Local\Temp\tmp240755187.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240755218.exeC:\Users\Admin\AppData\Local\Temp\tmp240755218.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3620
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 612KB
- SHA256 d98d3f3c404526f278c6aa1b9ce0dbba29e866eda6e55cabe5348b4806c29df2
- MD5 992ad57d420b100257d21c3510e6a216
- SHA1 0b6935ae31824241cc2eb8d88bf9dbcffa560951
- SHA512 96fd65a4d07157d138c93b0743e086f4e33c7d6b29c4a1cdf32c8ae1b8c781cad291884692f13f344e0405421b853bcb8ffdbb1986a306ea91084a9b2a9a121f
- SSDEEP 12288:HP7KHPDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:et0Le5ji0hmxNrM
- TLSH T186D41916F6748731D073C0B9C9D2A69AED7230815B308ACB5286C77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240755187.exe
- Size 52KB
- SHA256 4e6644c21fe92d40d475a8477d57baee37ca84905ffaffbff77661b55722cda6
- MD5 20c9b9e24bbf673ef93af45ea3026f68
- SHA1 710453910c31a53252ff49ab968d1d9e9e99a88b
- SHA512 78f430f4445b939f2e0ef93bca830b850545a567860dc5ce278b71615f67628c68ed73a42c07e864155f5acd09a53e314ae6e67ac7e59a147339b1a3f2cade35
- SSDEEP 1536:S5qsVsIEVfELAlHa6K0mrdkT9lcP1LOQt4KWZkr:cVv08LewxwcPZOQt4KWZkr
- TLSH T13D336C1EF581C873D02509FC4D19D1A6BD6A76307D694267BEED0F0DE9BA2C24E0C2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240755218.exe
- Size 14KB
- SHA256 cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a
- MD5 e03115ee7530777231a0051667ab23d3
- SHA1 5ded32077cda52b5527f75017552a598b0523db7
- SHA512 053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee
- SSDEEP 192:iplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827QN4y+NXNUoynP+yJihMiM28d/o:ElgQ3655Kv1XIRV2QiwXax+yJ+Mi0
- TLSH T1CF62E502CBA454E1FBFB0631B9FA29875AB6BD104894DE1E47B07F9D0C34680E566367
- MD5 SHA1 SHA512 SSDEEP TLSH