414f95dc5dd0b28dea4db16a7803b15382dec8bad313fea0a26bfb0147d8eb48

Analysis

max time kernel
149s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_471e4523b8a1748413195d4fe7e6d57c_elex_mimic_pay2key_wannacry.exe
Size 40.9MB
Sample260522-dap8aacy3r
SHA256 414f95dc5dd0b28dea4db16a7803b15382dec8bad313fea0a26bfb0147d8eb48
MD5 471e4523b8a1748413195d4fe7e6d57c
SHA1 829410faee63b5e52184b0f461f79f0b86467d90
SHA512 b35e674130aca5762ca251555339865bd4014a54e8e6f3eaa034accf25c49ec7497b41705eb91b7730300ae52d5d91ec22c7d3cbe45a6832e5bd6e5f874662b6
SSDEEP 98304:sR5852Er0Lvq9WUw4SLBjee9RjQPbRUoY:sRS52Er0LvrUw4soe99QPb+x
TLSH
T11D9733973392C0B4E5E62F348ABB2AD24C64D5A5072A86D7B5C84B13C7F59F0763E087
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b591-36.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4008-37-0x00000227F34D0000-0x00000227F35DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Executes dropped EXE 4 IoCs

pid	Process
4632	7z.exe
2612	7z.exe
2408	7z.exe
4008	Updater.exe

Loads dropped DLL 3 IoCs

pid	Process
4632	7z.exe
2612	7z.exe
2408	7z.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4008	Updater.exe
4008	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_471e4523b8a1748413195d4fe7e6d57c_elex_mimic_pay2key_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	Updater.exe
4008	Updater.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	4632	7z.exe
Token: 35	4632	7z.exe
Token: SeSecurityPrivilege	4632	7z.exe
Token: SeSecurityPrivilege	4632	7z.exe
Token: SeRestorePrivilege	2612	7z.exe
Token: 35	2612	7z.exe
Token: SeSecurityPrivilege	2612	7z.exe
Token: SeSecurityPrivilege	2612	7z.exe
Token: SeRestorePrivilege	2408	7z.exe
Token: 35	2408	7z.exe
Token: SeSecurityPrivilege	2408	7z.exe
Token: SeSecurityPrivilege	2408	7z.exe
Token: SeDebugPrivilege	4008	Updater.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1228	1500	2026-05-22_471e4523b8a1748413195d4fe7e6d57c_elex_mimic_pay2key_wannacry.exe	80
PID 1228 wrote to memory of 5752	1228	cmd.exe	82
PID 1228 wrote to memory of 4632	1228	cmd.exe	83
PID 1228 wrote to memory of 2612	1228	cmd.exe	84
PID 1228 wrote to memory of 2408	1228	cmd.exe	85
PID 1228 wrote to memory of 4960	1228	cmd.exe	86
PID 1228 wrote to memory of 4008	1228	cmd.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4960	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_471e4523b8a1748413195d4fe7e6d57c_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_471e4523b8a1748413195d4fe7e6d57c_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p648828844485527956116012544 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- - C:\Windows\system32\attrib.exe
    attrib +H "Updater.exe"
    3⤵
    - Views/modifies file attributes
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
    "Updater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
TLSH
T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
Size 1.0MB
SHA256 7cf84a809c23b0e37c1d3d2f99592b3cd0c8bf27c4d164129f0972a12f0d2251
MD5 be323826173bb179dacdca7e6b36665a
SHA1 4f0b66e1f455bd24cbbde8d972c5001aa42ff301
SHA512 0245976cda5170b5466d5bf10423e348c63ea2263407dd4132c0ffde78b17d10a1c5eccddd83d0a5e020916af0b0751d6520504c4e724f7a5919681f15afe1ed
SSDEEP 24576:IZOX6eCUIURtQ3yhJfZqomXlFRuHtlWj/5UfDrInie+S:IZCZIUIyIomlFgN0jRUfD
TLSH
T16C35D0455BA6ED02D27E6379806046C087FD95146E87EB1AE3D43EAB6ECF342DB0704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.3MB
SHA256 d41357e3e5639cf3b1fe7d9f5139df85a4dabe2450c053169a3e509e23388ec6
MD5 2f937e2aaf75a00c71877ccf9702e1fc
SHA1 d14a9337541b9728651b79b01030ce0ae1c2495b
SHA512 5c44694f114111289909553921360bedd16f06004850e6f11f9572b813dde8d183f9b2986b6c048bd0bb525882301b675732ffdab811d16118591a797090dd14
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/x/:R9kqGu7okoZscCnf0/Zs9k
TLSH
T19CB501E4B7C8BCC68B9E93D7A1518EAE133311FB9993548C0586BBC91E1B785DF1C884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 745KB
SHA256 3a54b7ebc4790d1fb7dc5cdc5d870e61a25548aefac7db9bad4c39aa4ef4e716
MD5 d2de983a84703b70a8960cea6e6f66b9
SHA1 200dee053ceab90d4037849109f6c3b98d8ef069
SHA512 668c6abbbff109d782a13dc5a0124714b6bb722d3f06e4a2ac22e7d6bec37e62dffdf52de1a5ba88845f023c8d5afac8c069ecc293d25a733d3051b40893e91b
SSDEEP 12288:1WD5ixOXmOnTP2OWZNkH1X0VVhfqNnnb12okxEp2Jq1tvfvs0fTbyxSDIdr9acVf:oD54OXmeOOU25xb12okKxZXs0fPyV9cS
TLSH
T19DF42390B22071633D72A2E1DE965936DA339989CEB64F75F309C02D92E46A703507FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 2.4MB
SHA256 417334b03d29cfa7492f1edc20ff9fe57a8cc7bdd7bfd10af25006ffa2d0496f
MD5 95265566621da5f7fb75cf622f4447ba
SHA1 692372d506c231235e7b7fb5216094a721c4cbf5
SHA512 b077ad538a4329d35c5835a72f667cb9e9906dd5388fcd768c2f5e476d5463598eef5ea2384f74bdc4b24092ba44f5e9eb62d086bd8460b3ea9f97dddba8f971
SSDEEP 49152:NujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oYACCHUu2ok8s0fPyvo:NaR3D0Ae5mwdkDWm1XoeCUJys0fPso
TLSH
T154B533449071ABF6BC31A1748D9B8531CA33A9F1DE6B4AF4798C301852B76BE1D4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 2.4MB
SHA256 ec0ed9bc5864fe103b403b00a6a6bdc6023a822cede152e079c2ba58f4d4117e
MD5 af60850cb4bb3c80255b35135155275c
SHA1 2c71c29a391759e8dd2ab2463245d18e2f878402
SHA512 a5f22b1a2f37c1d5d70fba39aded93e22a67e486fa2f8cbd605b204b943b0bd6b0c444c8f48b72c11260853cc8e1811f742d39e04f82e12f3fbd8dbfa657ee11
SSDEEP 49152:YYnkx36y28cjsq7TmMmdC+A5d5F5nM2hPT2SnU4w78p11k:n+3tdATmMmT05HMgfURsXk
TLSH
T1FAB5334F69D02B65C969DA9BC8B1863F2BB40D0363F31DDB7640F262B120B2E67D1925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 463B
SHA256 37578abc4a027d60afc7a9b82114f9485f521bfa604975b8e4ee86facbb92016
MD5 f9b97cddbd8c0ea702d4d3aecd28adc6
SHA1 42abb11b3470ee147d63368dea10427466416525
SHA512 8723ebc0f1880ca4ed6139e84b243a87c16b7d8e7dc655f13f83835b1d5b73c7b3534a70d664619dbf683c6e39ee7c74c454bae0643074d07af442786a42dced
TLSH
T1C0F0274428C7C9B24CD52589128C2ECAB12B944AC11F4F0019D000EE58599ECD4CBFAB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4008-37-0x00000227F34D0000-0x00000227F35DA000-memory.dmp

Download

memory/4008-38-0x00000227F39F0000-0x00000227F39F1000-memory.dmp

Download

memory/4008-39-0x00000227F5D60000-0x00000227F5F22000-memory.dmp

Download

memory/4008-40-0x00000227F5AB0000-0x00000227F5B26000-memory.dmp

Download

memory/4008-41-0x00000227F6460000-0x00000227F6988000-memory.dmp

Download