5a4d6c82812db0c6c535d66e30bdbda0346d2c91be4083256c834421c9acf9a1

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe
Size 131KB
Sample261104-xt1b5scx7v
SHA256 5a4d6c82812db0c6c535d66e30bdbda0346d2c91be4083256c834421c9acf9a1
MD5 6045b7db2400cb83c4d2d815fa134f53
SHA1 9cfeb4d2306a042f2a08c064fce1d0ac1f9e9553
SHA512 41d9397269ae50eca002bfc1658b82049936fef4c642d487c19ed7aea859f86be5f05c0385505b37494e81d77fa4cec1ac0b3d4ef6bbcf6d4dfe828690039344
SSDEEP 1536:qxDQSrO60trm4+GNgEPDrQc9XYfr13zSZZ9v5kDPBQUNxkVnQnJuOP0fO:YM+GNdDr3Y53zSZ/v2PCe6Qnf0W
TLSH
T120D39D656542C822C040563B6AF6D7F612B13DB62E097B13BFA8F7BF08B3944ED0D644
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4396	efadxggn.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	efadxggn.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4640	4396	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efadxggn.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4404	cmd.exe
4720	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4720	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5548	2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe
4396	efadxggn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 4404	5548	2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe	89
PID 4404 wrote to memory of 4720	4404	cmd.exe	91
PID 4404 wrote to memory of 4396	4404	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\efadxggn.exe "C:\Users\Admin\AppData\Local\Temp\2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\efadxggn.exe
    C:\Users\Admin\AppData\Local\Temp\\efadxggn.exe "C:\Users\Admin\AppData\Local\Temp\2026-11-03_6045b7db2400cb83c4d2d815fa134f53_elex_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 468
      4⤵
      Program crash
      PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4396 -ip 4396
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

efadxggn.exe

Path C:\Users\Admin\AppData\Local\Temp\efadxggn.exe
Size 131KB
SHA256 04cb59c69f929d45902d7469006954d4a4de3293c76270e9079d48816da8be4d
MD5 bb76821a243408914301ef5b0e8b3d4c
SHA1 4137d00a276301e009e57c4b0a2e184e723a2702
SHA512 c859dba2e02e33db71b425d75537fe64b3f6117027e036f0cec8d88069b7ce56c2849ed51d1cee7d96cfc3f32148920b063a6b44f855fd7302fd0e37d800b5d1
SSDEEP 1536:qxDQSrO60trm4+GNgEPDrQc9XYfr13zSZZ9v5kDPBQUNxkVnQnJuOP0fK:YM+GNdDr3Y53zSZ/v2PCe6Qnf0y
TLSH
T1BED39D656542C822C040563B6AFAD7F612B17DB62E097B13BFA8F7BF48B3944ED0C644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download