General
- Target 2026-11-01_bfce9e0177cc3fdac3dc885c8fec7e9e_elex_wannacry
- Size 1.1MB
- Sample261102-lwsvassvdv
- SHA256 1cf47e2f2208f29b3844da71a1e0fe74c4c3960d5bb5d6c0d4940fd65c79ea30
- MD5 bfce9e0177cc3fdac3dc885c8fec7e9e
- SHA1 3aa22a9957b2f9f69b42d0374092fd2de66c96f7
- SHA512 2baf13ada6f4e68b82143fe0115caf0ed30e82a564a2c6d387d9b807804e5c6dbe29419e70e5f8a38359615629beda661af1077b99c55bdeb397d47bfde4cc93
- SSDEEP 24576:1tn+y74L47cJ+Kre28/3sY6GkStsq+K5X:1gr4GeZsYfh+s5X
- TLSH T13F3533D499FC2788FA290175625B777EFCBA38908725A22E9D014C24EDB2330DE7D5C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-11-01_bfce9e0177cc3fdac3dc885c8fec7e9e_elex_wannacry.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-11-01_bfce9e0177cc3fdac3dc885c8fec7e9e_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target 2026-11-01_bfce9e0177cc3fdac3dc885c8fec7e9e_elex_wannacry
- Size 1.1MB
- SHA256 1cf47e2f2208f29b3844da71a1e0fe74c4c3960d5bb5d6c0d4940fd65c79ea30
- MD5 bfce9e0177cc3fdac3dc885c8fec7e9e
- SHA1 3aa22a9957b2f9f69b42d0374092fd2de66c96f7
- SHA512 2baf13ada6f4e68b82143fe0115caf0ed30e82a564a2c6d387d9b807804e5c6dbe29419e70e5f8a38359615629beda661af1077b99c55bdeb397d47bfde4cc93
- SSDEEP 24576:1tn+y74L47cJ+Kre28/3sY6GkStsq+K5X:1gr4GeZsYfh+s5X
- TLSH T13F3533D499FC2788FA290175625B777EFCBA38908725A22E9D014C24EDB2330DE7D5C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies firewall policy service
Adds policy Run key to start application
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3