1e25b17ac686f337d6187e91a985dbffcc3a9bcbac96088eb0870e5a39f5c822

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
Size 324KB
Sample260523-cdrpvac16v
SHA256 1e25b17ac686f337d6187e91a985dbffcc3a9bcbac96088eb0870e5a39f5c822
MD5 205d8d79b80c2b18ff8433011a2ff1f0
SHA1 2f33159f49c9bed3d680e26b8ed6427f4c5d43c0
SHA512 924fc336f145404967c96dba94448b1d8a59d947a91ee7a6c893b168e87166387d67cfe547b121857be2a37bc3f019e4acdac0019c0e599736e2f1d3ec113c90
SSDEEP 3072:79P+8Oif5N9tNs9wkaH2UdjYR0zz3TxW4CoE+A9x9IKMJ9yNc1qI6IVGg+BrVxU:Zv30UagzNqoEVI+I6IVGgmrV
TLSH
T1F864D553BEA44466E9AAC7741C738C81C7B5B9110EA5C10EB15883CEDE3B796D93CB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\shvc2\Parameters\ServiceDll = "C:\\Windows\\system32\\240650078.dll"	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe

Executes dropped EXE 1 IoCs

pid	Process
5256	shvc2.exe

Loads dropped DLL 3 IoCs

pid	Process
2424	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
3712	svchost.exe
5256	shvc2.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240650078.dll	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
File created	C:\Windows\SysWOW64\shvc2.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\shvc2.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shvc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5256	3712	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "shvc2"
1⤵
PID:4412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "shvc2"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\shvc2.exe
  C:\Windows\system32\shvc2.exe "c:\windows\system32\240650078.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "shvc2"
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240650078.dll

Path C:\Windows\SysWOW64\240650078.dll
Size 32KB
SHA256 efbc8749b8508ac0508a8cbda98f9ea16f06e1226b174a4da6e63eaac0d63392
MD5 b17875c911c489829c01169ea6ee8c65
SHA1 c723ac5e7bce0633f0ca69daae53aa51dc4ad39f
SHA512 162b718bbbe98a03459f0b4ec7f6299c9124b85e7bf65a6e5d0d4ebed5836f17628a6f834e6dcf7ba795051dfa8d9b8c1e7af62ea89c9705309212630958a45e
SSDEEP 768:tXf7HZ3PF7jIXanJSHzjCq1O4UUHyxnjJMGWS:p53PIuJ0Cq1OlUH+nj+GWS
TLSH
T133E23A12729084F7D692813475452B379BBFF8700A6CA053E7B70A9E5DB9CB9F628343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shvc2.exe

Path C:\Windows\SysWOW64\shvc2.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
TLSH
T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
MD5 SHA1 SHA512 SSDEEP TLSH