Overview

overview

6

Static

static

3

2026-11-01...ry.exe

windows10-2004-x64

6

2026-11-01...ry.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 13:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_9f1af6e5c6599536804412cdce1f81d4_elex_wannacry.exe
  • Size 404KB
  • Sample261102-qnqr7aat21
  • SHA256 f363fe14773b05dabe177e5392d44d5a5ad53d08f925f768c327840a7eebe2ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_9f1af6e5c6599536804412cdce1f81d4_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_9f1af6e5c6599536804412cdce1f81d4_elex_wannacry.exe"
    1⤵
    • Enumerates connected drives
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:4712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Destro
        • Path C:\ProgramData\Destro
        • Size 57B
        • SHA256 1719d3cd70af488f4df6e91429a89b3759a8fd24804573c4d79c92da7aa18805
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132550_1.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261102132550_1.a
        • Size 2KB
        • SHA256 a1d8389d7079e13fe820ff9cc33baed42b9304a9729a92331e275292bf44ad67
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132550_2.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261102132550_2.a
        • Size 3KB
        • SHA256 b218c3f5e6f7ecf47e33f1448a2b30c1f15b363e24287e21f297341b7746daa2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132550_3.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261102132550_3.a
        • Size 392B
        • SHA256 649bc75bc0873774d83daa65ea5d72f50c6005e432893bde5c5281f916a5c01d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132555_4.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261102132555_4.a
        • Size 273B
        • SHA256 7cdc1ce582881eb92cad1fd6d8f662a3d6e66c09fde93061db29f2e30b15a832
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132554_00000029.s
        • Path C:\Users\Admin\AppData\Local\Temp\~B4D8\20261102132554_00000029.s
        • Size 46KB
        • SHA256 65d40117dc60e11383fb19ec7312438ed919b7793b17ab2d755e38a1d0097cab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        20261102132610_5.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132610_5.a
        • Size 2KB
        • SHA256 08e0d575698a46f05fc068211f71216873e7f7a389919380e63167f9fff104d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132613_6.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132613_6.a
        • Size 2KB
        • SHA256 990576ec79b6d9f0bc3d28d1e27ab0b28c675cca783518797a364a299bc4ff32
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132617_7.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132617_7.a
        • Size 2KB
        • SHA256 bec6fa89e4cecf51b362972ee2bae7d56bc9a224f77a8ec707378ac4bc4b137d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132620_8.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132620_8.a
        • Size 2KB
        • SHA256 99dfc3f76e70cdd15fc11d1d1038cae7e738e1aa83e58fc434450bc56a106124
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132626_9.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132626_9.a
        • Size 2KB
        • SHA256 92a998fb2cd03072a9ba21a3a0588aee36f1c1d44771af291a613a45b88bbeb7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132632_10.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132632_10.a
        • Size 2KB
        • SHA256 cd8fc79f9e62dee5ed6ae957015efafae05fc6139accb479bce9d86ae1bfe196
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132636_11.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132636_11.a
        • Size 2KB
        • SHA256 6f48a72d353020487985875905a7fd5304eb9edbd4af65ccab197105474a364a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132640_12.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132640_12.a
        • Size 2KB
        • SHA256 9afc15f210f250edb5506d0898c401f54705d450d369fa3addf036df39f72648
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132646_13.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132646_13.a
        • Size 3KB
        • SHA256 7f37ac4e5415460fba0dd098f6048720a1ae81867dbfc5c2d940909be4914564
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132649_14.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132649_14.a
        • Size 3KB
        • SHA256 f809d9f5a717589338d6a26934bc0c0737313f1204eae5071a2209bc54c92cc0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132653_15.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132653_15.a
        • Size 3KB
        • SHA256 100430ab79e15cbdac2e4c973fbaa568e8b61110cd81a911cc04659256accf48
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132657_16.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132657_16.a
        • Size 3KB
        • SHA256 286aa75901c15c61d9323e0b4140c318bfeb62d35ad5c6b08dd09a97788f8e65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132700_17.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132700_17.a
        • Size 3KB
        • SHA256 da389600a3d367e4cb953557b3c0845c61c90366162ec7f3a50a8fabe5c2a5cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132703_18.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132703_18.a
        • Size 3KB
        • SHA256 a317d6148a915fffd8805f6ca437b6291c61ffe153c1a1d63f7f8796485c8ae0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132707_19.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132707_19.a
        • Size 3KB
        • SHA256 34735eb1414951fd81e3a401c6f42066bac5b662a50c2e0b5eb49caec0cf5a2d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132710_20.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132710_20.a
        • Size 3KB
        • SHA256 4f95d57275f66793fb87a2009feb0aff45c85b14f9b717f6531a4f841a9531d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261102132713_21.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261102132713_21.a
        • Size 3KB
        • SHA256 4136c40e163a4cfbee60e96f68ad0bcd4f9a20ebe24d262b53aca3c2b3193f08
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4712-1-0x0000000010000000-0x0000000010032000-memory.dmp
        Download

        memory/4712-0-0x0000000000400000-0x0000000000465000-memory.dmp
        Download

        memory/4712-8-0x0000000000400000-0x0000000000465000-memory.dmp
        Download