c687d6b29f6ec001aa7e2d135dfb690df31d0be950c12d4c5c255eb4ba836d8e

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe
Size 325KB
Sample260505-e5h8wscv2m
SHA256 c687d6b29f6ec001aa7e2d135dfb690df31d0be950c12d4c5c255eb4ba836d8e
MD5 f8785ce4602bfd1011e1d30e2fbeebd1
SHA1 759b5ebefd77b52ffcfad6012a100e28f13dd3dd
SHA512 29152c360ea55e7b7fd0fba8efddc04078bddf458e5cadec3c20b4a539d6ea87d75056e1fc66c5ad74bbef0a7c2b1e5bd961d84b2d833a809e102589e3969435
SSDEEP 3072:FRoTSgQHfT5h+T3GuGYeO6bUT3JyDhkUAyLj6lgvqcOoyqsu/T2JS5073VLm:FRoSgWtkT3sO6bSZMhRrygvjpsASJV7s
TLSH
T13064AF1275D0C8EAC1C53973CD65B6F4E3E9CEE8C9329A6B17E43E4C7E3A5048712269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2384	bezvn.exe

Executes dropped EXE 2 IoCs

pid	Process
2384	bezvn.exe
1360	wsswhnlmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1360	wsswhnlmd.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\vaugc	bezvn.exe
File created	\??\c:\Program Files\vaugc\wsswhnlmd.dll	bezvn.exe
File created	\??\c:\Program Files\vaugc\wsswhnlmd.exe	bezvn.exe
File opened for modification	\??\c:\Program Files\vaugc\wsswhnlmd.exe	bezvn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	1360	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bezvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsswhnlmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3276	cmd.exe
1188	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1188	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3684	2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe
2384	bezvn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3276	3684	2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe	79
PID 3276 wrote to memory of 1188	3276	cmd.exe	81
PID 3276 wrote to memory of 2384	3276	cmd.exe	82
PID 2384 wrote to memory of 1360	2384	bezvn.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\bezvn.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\bezvn.exe
    C:\Users\Admin\AppData\Local\Temp\\bezvn.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8785ce4602bfd1011e1d30e2fbeebd1_elex_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - \??\c:\Program Files\vaugc\wsswhnlmd.exe
      "c:\Program Files\vaugc\wsswhnlmd.exe" "c:\Program Files\vaugc\wsswhnlmd.dll",GetBMP C:\Users\Admin\AppData\Local\Temp\bezvn.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 432
        5⤵
        Program crash
        
        PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wsswhnlmd.exe

Path C:\Program Files\vaugc\wsswhnlmd.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
TLSH
T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bezvn.exe

Path C:\Users\Admin\AppData\Local\Temp\bezvn.exe
Size 325KB
SHA256 13278104ccf59fadad8929b1b7e315d4bf62c47ed2cd78f5a91c0ee6f60c61b5
MD5 8d058d685eb9b4a5f5870883c508dd3e
SHA1 caaaab6221a5f19b8e9aab8256a6b9569cfd4937
SHA512 c5f73e39679dc597c4b629497181f37c00fb102b75067d96e05ea0555960887907ef3b5f715f9fd0763a32b43a2bfd04fa4eca6b43eb9e5805e84f665e45bf51
SSDEEP 3072:FRoTSgQHfT5h+T3GuGYeO6bUT3JyDhkUAyLj6lgvqcOoyqsu/T2JS5073VLk:FRoSgWtkT3sO6bSZMhRrygvjpsASJV76
TLSH
T18E64AF1275D0C8EAC1C53973CD65B6F4E3E9CEE8C9329A6B17E43E4C7E3A5448702269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsswhnlmd.dll

Path \??\c:\Program Files\vaugc\wsswhnlmd.dll
Size 143KB
SHA256 44e8715d48a66b7812975ebcecaa33de60bcd90c04b529ac102ed7108dff37ad
MD5 c33e1179bf11c79d046e12ebb13c1d20
SHA1 7aefa727533737965dcc159fbe3eeae29f5cd2b1
SHA512 7a2afaef51021a50fe912cfcc8f84b404bb42bbb2ebe0a640c74cff96cc552a2fcd158b21e5046852f51b94b0357f2e2da45f6f3d172097a299253921f697aa4
SSDEEP 1536:6UmjB4YGcf3L2bo6OJVyDLIjfK+sOiFd2BQG8dk0tJTaNlZffpgKNfz:fdYXSqEL8K+sP2BuHJTaNlhfVNL
TLSH
T1F1E302907C9F15A4D02006B3069496791AFD493AE6EE53E37A5CF96B4305A06F31F00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-17-0x0000000010047000-0x000000001006D000-memory.dmp

Download

memory/1360-16-0x0000000010000000-0x000000001006D000-memory.dmp

Download

memory/1360-18-0x0000000001670000-0x000000000174F000-memory.dmp

Download

memory/2384-13-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2384-11-0x00000000009F0000-0x0000000000ACF000-memory.dmp

Download

memory/3684-0-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3684-3-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3684-2-0x0000000000B00000-0x0000000000BDF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads