1165483d328334d0b8557224c7eb68d521ac49f1225215da90de88d0e455a08e

General

Target
2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
Size 620KB
Sample260507-cfmtnsdw81
SHA256 1165483d328334d0b8557224c7eb68d521ac49f1225215da90de88d0e455a08e
MD5 44fb4f19b3c42be5076a993cbcdbde29
SHA1 f5ea96129f2cc92caf3c0ee622b3af7c90c317fd
SHA512 f4871f9771206766d317a4a62187c2d9dfc5686b5a7623ac19b1f3decd77bc0c9f4831247c4fe5205a5c25a605ee74b95bdd46e9f63964ec84e5362f4a16e276
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+7:An4bgVhNrAM1qgg2jfOM
TLSH
T11CD47B1153EA0116F1B7973178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1248	wpaec.exe

Executes dropped EXE 1 IoCs

pid	Process
1248	wpaec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpaec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
248	cmd.exe
3476	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3476	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3084	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
1248	wpaec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 248	3084	2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe	78
PID 248 wrote to memory of 3476	248	cmd.exe	80
PID 248 wrote to memory of 1248	248	cmd.exe	81
PID 1248 wrote to memory of 5732	1248	wpaec.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\wpaec.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3476
- - C:\Users\Admin\AppData\Local\Temp\wpaec.exe
    C:\Users\Admin\AppData\Local\Temp\\wpaec.exe "C:\Users\Admin\AppData\Local\Temp\2026-05-07_44fb4f19b3c42be5076a993cbcdbde29_elex_strictor_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\ahrovy\qylng.ynq",RAFlush C:\Users\Admin\AppData\Local\Temp\wpaec.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wpaec.exe

Path C:\Users\Admin\AppData\Local\Temp\wpaec.exe
Size 621KB
SHA256 952e39d05ad890f67eb43ba786f9323023f93b62c320a2d44d90d5a3419e2259
MD5 c07f4d188cce7e65b0ad30691fc46d26
SHA1 92cff31ac21b5481c1ad33e937946aad8e1b5980
SHA512 7bab84c4f7572f134ef5327ff15a96a49846bdd9a22fd595d32567c0ab47034fd8054408a7ebd51e4daeb47c5840db0a59a6e25baf652d356a65d48de192ee99
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+p:An4bgVhNrAM1qgg2jfO
TLSH
T190D47B1153EA0116F1B7973178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qylng.ynq

Path \??\c:\ahrovy\qylng.ynq
Size 155KB
SHA256 42097ad9ae64e2ff7ed139fef0a7eb53c57a37c9215ebc275411841e198c3e02
MD5 a8c9fc170d8d954a4c27141f56db38f3
SHA1 3e9bd10e353469f8e540de675a63fed8cc70bdb7
SHA512 5793c869c862bb77d92a9045ed5a951bd57837b7d631c7ea03a1764f7f0c6ceae68bbfb1f6f7f3143829d5b53f5973d3f1f3e6afc47bd3822251f0beb5c37f9c
SSDEEP 3072:zqVT34l0v8ljGh11D/cWiREpUDC4Li/F+fF9CTJ/AZMlDfogExfE:zQu0vsah3D/cWiWp9TdlDwgExc
TLSH
T15EF3E7534BC66719886805FCA8E28D9781848BD089BC3FFAC07194FF9C95926E4EF7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-9-0x00000000009F0000-0x0000000000AAB000-memory.dmp

Download

memory/1248-10-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/3084-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/3084-2-0x0000000000B40000-0x0000000000BFB000-memory.dmp

Download

memory/3084-3-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/5732-12-0x0000000000B30000-0x0000000000BEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads