1165483d328334d0b8557224c7eb68d521ac49f1225215da90de88d0e455a08e

General

Target
2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
Size 620KB
Sample260507-cfmtnsdw81
SHA256 1165483d328334d0b8557224c7eb68d521ac49f1225215da90de88d0e455a08e
MD5 44fb4f19b3c42be5076a993cbcdbde29
SHA1 f5ea96129f2cc92caf3c0ee622b3af7c90c317fd
SHA512 f4871f9771206766d317a4a62187c2d9dfc5686b5a7623ac19b1f3decd77bc0c9f4831247c4fe5205a5c25a605ee74b95bdd46e9f63964ec84e5362f4a16e276
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+7:An4bgVhNrAM1qgg2jfOM
TLSH
T11CD47B1153EA0116F1B7973178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5256	iazfj.exe

Executes dropped EXE 1 IoCs

pid	Process
5256	iazfj.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iazfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4672	cmd.exe
4784	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4784	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
5256	iazfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4672	4796	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe	85
PID 4672 wrote to memory of 4784	4672	cmd.exe	87
PID 4672 wrote to memory of 5256	4672	cmd.exe	88
PID 5256 wrote to memory of 3840	5256	iazfj.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\iazfj.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\iazfj.exe
    C:\Users\Admin\AppData\Local\Temp\\iazfj.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\zlgog\hhlxjarj.hxh",RAFlush C:\Users\Admin\AppData\Local\Temp\iazfj.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iazfj.exe

Path C:\Users\Admin\AppData\Local\Temp\iazfj.exe
Size 621KB
SHA256 d9b95ab3cec778341bac5fcc7b872fd773542e66b062bd996fcefd0099217570
MD5 a21829535582ad363b551f5af6998d33
SHA1 9e5ab4eaced0e0ad48f837531ee583598adc2451
SHA512 9ea60791ca113c1a47bd3e6a750d9dea79aea5e236809f4acfc9a8a7d0daec874ea98d0bd73453615158a65d23a21ceef58783ffebddf476808a0cce97b69f82
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+p:An4bgVhNrAM1qgg2jfO
TLSH
T188D47B1153EA0116F1B7973178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hhlxjarj.hxh

Path \??\c:\zlgog\hhlxjarj.hxh
Size 155KB
SHA256 42097ad9ae64e2ff7ed139fef0a7eb53c57a37c9215ebc275411841e198c3e02
MD5 a8c9fc170d8d954a4c27141f56db38f3
SHA1 3e9bd10e353469f8e540de675a63fed8cc70bdb7
SHA512 5793c869c862bb77d92a9045ed5a951bd57837b7d631c7ea03a1764f7f0c6ceae68bbfb1f6f7f3143829d5b53f5973d3f1f3e6afc47bd3822251f0beb5c37f9c
SSDEEP 3072:zqVT34l0v8ljGh11D/cWiREpUDC4Li/F+fF9CTJ/AZMlDfogExfE:zQu0vsah3D/cWiWp9TdlDwgExc
TLSH
T15EF3E7534BC66719886805FCA8E28D9781848BD089BC3FFAC07194FF9C95926E4EF7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-12-0x0000000004740000-0x00000000047B5000-memory.dmp

Download

memory/4796-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/4796-2-0x0000000002180000-0x00000000021F5000-memory.dmp

Download

memory/4796-3-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/5256-9-0x00000000021B0000-0x0000000002225000-memory.dmp

Download

memory/5256-10-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads