1ba40b71e45821715380821dddbefdb0a76e4999cd237108c69fb2a02f527b03

General

Target
2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
Size 145KB
Sample260418-errywagt4v
SHA256 1ba40b71e45821715380821dddbefdb0a76e4999cd237108c69fb2a02f527b03
MD5 12b611e334875b1c002597c47cdef68a
SHA1 1825599e2d9c969a60ffe2cc763706f8cda8221c
SHA512 f074c571177a98b1bb158307918c98533f1e7ee75749752ecf9d8c6fef9ef51db42aaf54fa519b726b76d560b7112442a46dbe06a37ee84934cb2b1f3a79cfae
SSDEEP 3072:pw5Ha2zlnz7wfOFg9YDGDXlcl+JEGLy1+gF6:2da2zlPRlS1efGuEgQ
TLSH
T189E3AD06BA084732D51AC3711D2F6D364F51AF2C28E0926F67A26E0F2DB07B15E5D26F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe

Executes dropped EXE 2 IoCs

pid	Process
5772	SV0H0ST.EXE
3364	iexp1orer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexp1orer.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexp1orer.exe	iexp1orer.exe
File created	C:\Program Files\Internet Explorer\iexp1orer.exe	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
File created	C:\Program Files\Windows Media Player\startplay.wav	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
File created	C:\Program Files\Windows Media Player\SV0H0ST.EXE	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SV0H0ST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Animations = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Videos = "no"	iexp1orer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
3364	iexp1orer.exe
3364	iexp1orer.exe
3364	iexp1orer.exe
3364	iexp1orer.exe
3364	iexp1orer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 556	4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe	85
PID 4928 wrote to memory of 3364	4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe	89
PID 4928 wrote to memory of 4064	4928	2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_12b611e334875b1c002597c47cdef68a_elex_wannacry.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\1776485451.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:556
- C:\Program Files\Internet Explorer\iexp1orer.exe
  "C:\Program Files\Internet Explorer\iexp1orer.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4064

C:\Program Files\Windows Media Player\SV0H0ST.EXE
"C:\Program Files\Windows Media Player\SV0H0ST.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1776485451.bat

Path C:\1776485451.bat
Size 783B
SHA256 935b8edbfc750fab380e6ebeea20ced5c476f06149d26f58ec12965467980e10
MD5 cd181117b628fb5d81f0a73922918ff1
SHA1 799f6ca1e7cbf7a3941fd17b2b5593e1d1c7c801
SHA512 e55b7746f86d18f5607230c42c5c875fb4951da6a4327b07e5ea906b3bdf2153c82e0efbc995282f154a3c8d016626314a0a6217f15c3ec2b2b0d5e0acff6664
TLSH
T12E01BD46CC3B43F0E111A04DB72A8D84AE0FF11993E0091B53AB7E51AC4599AB6E654D
MD5 SHA1 SHA512 TLSH

Submit Download

iexp1orer.exe

Path C:\Program Files\Internet Explorer\iexp1orer.exe
Size 40KB
SHA256 223f9ed55d6b851790df45da8ebbae94de04a84dea1d5f5b9344c4612cc8c2fd
MD5 b17fcc08fad1a036200822a49421c761
SHA1 0f327a3d1d7d7e4b97a78d4698d54e6df85d6344
SHA512 37a1e6acf40438911993441eb35bafbb6d8e9b0a8c59f0754fd3ccd5cb7233a42bcd30715257aa6d1f9972c1dcdfdf9ae3e0a2e79f00351f48f3010ac08665cc
SSDEEP 768:4t7tn/xXr+Y070KVhIXdwyre4cL331SbGaqkL:MXw0KzILe4w1Sqa
TLSH
T1870349233A67449ECB27DDB265AF17AED37BA2B21D248657D3422E0D5D34902FD1232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SV0H0ST.EXE

Path C:\Program Files\Windows Media Player\SV0H0ST.EXE
Size 20KB
SHA256 ff3d7155725d3074e80cda561af09852ca45737a6cc54689a22472e4031ee844
MD5 9ca9d0cd3a192be67bc69f88364f1533
SHA1 4aacb4278abafa54aad20de0829a88ee0cfe7129
SHA512 0d520b3c6965668737d78ef2fa78416ee6dd7b947d3821436e400ba9508322e6d703554bbd958f925f83983df249c441687849c616eb4b4a458e43b5d1aa3218
SSDEEP 192:BpHAbp6YlpTOfaCgOKUTTacRxvviK5WRIW9oBN8GETjN564oyntfR:BVAQYiHgOKUTTTN6UWWW9IAvN564LR
TLSH
T1D39209434D98D473DBC3B073891E651A5F7BB26871F4AE0386C51B4D68A8EF2CC3554A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startplay.wav

Path C:\Program Files\Windows Media Player\startplay.wav
Size 54B
SHA256 3368443266155f4fa9d232905ec522d9db0b2e3146d33d049ce9d3dfc4303fad
MD5 4a7091db02f1e3e05dabb92203f5fcca
SHA1 faa7ee2cc6196ec16b627cdb199db37ef0b9c22d
SHA512 ed8b233c4184f11b58b06d3dbbed183fc6a0d74d0bf579102708e26c1bbcd091275a533aaf4376c2620fa27479499db9c213c499c504193a7570d3319173cd64
TLSH
T191900281454B8554720224804741255026519424D54845B5FE9C475E65CB55440647E6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads