a876350adab28c052d0f8e05294b400b36c2428b20b12bbd016a381fea5d2320

General

Target
2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
Size 51KB
Sample260516-1bb4dac17j
SHA256 a876350adab28c052d0f8e05294b400b36c2428b20b12bbd016a381fea5d2320
MD5 2f0eb7765ee1de5a1e7e7f617d002c10
SHA1 b0c5aa1dfcc5375c1ec0330624c435e04782c123
SHA512 7fa0b7cdc81ccd7fb85e2eee56c1f11801a06fd4da1e9eefcec2ebc1b40b214222e22a952c5606d30fb82379b828f541d1884d3f6890e65f738c12e79b26435e
SSDEEP 1536:LNxU+W+73uSpoo3e/8+dcr2ySHCT89uuud7bOC6:PU+W+qNo3e9Sy/H4O
TLSH
T102339D125B96807FFD705AB81C8362BA811A6D2B224BED15E924FD214CD61E3FCF9313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\\\services.exe"	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rnma30 = "C:\\Windows\\system32\\.exe"	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\T	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File created	C:\Windows\SysWOW64\G\scservice.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\G\scservice.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File created	C:\Windows\SysWOW64\T\rnma30.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\G\mirror.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File created	C:\Windows\SysWOW64\G\netdhcp.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\G\netdhcp.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\G	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\T\rnma30.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File created	C:\Windows\SysWOW64\G\servicess.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\G\servicess.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
File created	C:\Windows\SysWOW64\G\mirror.exe	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3832	2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_2f0eb7765ee1de5a1e7e7f617d002c10_elex_wannacry.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rnma30.exe

Path C:\Windows\SysWOW64\T\rnma30.exe
Size 52KB
SHA256 6da04c4f022a533174dcc49c976bb41faeee1543b024a943a9c24223be95e18b
MD5 1ff78e8c987a85208b37c7d976e73e23
SHA1 9d73069be464ebcb12855d7a9a560b7b2f88dce9
SHA512 3f5f4c7b68ea903d62d30bda51006baa1d0b175df020a1aab8adfcd63b350f1d85f81e13a4097262f214fb9cedc6e05b2ff566042a3d8a1c2c94d38ea1ea1c0f
SSDEEP 1536:LNxU+W+73uSpoo3e/8+dcr2ySHCT89uuud7bOCK:PU+W+qNo3e9Sy/H4e
TLSH
T184339E115B96807FFD705AB91C8362BA81266D2B224FED19E924FD214CD61E3FCF9213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads