942a46067c13c2fab80bdb985fac19f8e12c6e836499a27434b11f1e69198261

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_7304caa0b831c32a389eb329b730db86_elex_wannacry.exe
Size 217KB
Sample261110-tkmg5sa18r
SHA256 942a46067c13c2fab80bdb985fac19f8e12c6e836499a27434b11f1e69198261
MD5 7304caa0b831c32a389eb329b730db86
SHA1 bf3a2caf7e8c7246315cb52de62ea44011bc55b6
SHA512 52fbc1cd87cd7bd0708ce99bede56c907a17b01d2463da8b05a5c858f3f3ce1670002e9d353f1e0bf080f42450213fa40e343b09c215846224a657edfe3e5579
SSDEEP 768:2pMoXSRw9Cu/oVksMfTFWedUnV4fFhxRUj3bnX9Z0kSBxdYb9Y+SZS:6aACuk4oedUnV4fjPgZ0Hxd+yLI
TLSH
T1DF247C166A402154F972CB75426BEAB100D56C826B90F1E77A53BAEE1733FE3FC71248
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4292	cadvahin.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cadvahin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cadvahin.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_7304caa0b831c32a389eb329b730db86_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cadvahin.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4292	2564	2026-11-09_7304caa0b831c32a389eb329b730db86_elex_wannacry.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-09_7304caa0b831c32a389eb329b730db86_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_7304caa0b831c32a389eb329b730db86_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cadvahin.exe

Path C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
Size 217KB
SHA256 d59e1e77b711610b371de19a5d59e882dccef2e143d703d4a91a3c50f5e76664
MD5 b973d985caa58e5d454318717710fefd
SHA1 fbde3516564c03867e0c4c3cd4154098d4c7ef0d
SHA512 1a6688db77215a43b389821b211c85e4bd5c4fd3b8a9d3eeb59837125b70b7702921e74838245a71dfc33d42ac2a8885ebbfd44ed1a5c44ea058da370631fecb
SSDEEP 768:2pMoXSRw9Cu/oVksMfTFWedUnV4fFhxRUj3bnX9Z0kSBxdYb9Y+SZc:6aACuk4oedUnV4fjPgZ0Hxd+yL+
TLSH
T19F247C166A402154F972CB75426BEAB100D56C826B90F1E77A53BAEE1733FE3FC71248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads