a54c6b94af36931362f0cdf6c30baf510c23a9c6f31b7df737b6ffafaf036bf0

Reason

Machine shutdown

General

Target
2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
Size 18.5MB
Sample260530-rap46sd15v
SHA256 a54c6b94af36931362f0cdf6c30baf510c23a9c6f31b7df737b6ffafaf036bf0
MD5 5bccd6ba8947f9588474ff3b5cf1c502
SHA1 b636ef422f54113fcd0e8f6deb9ac9ea001e77bd
SHA512 cb33f46c1844baf675c471a477b74fc7b548d8e3c432856600e988dfacf4660ae5db532535dd6eebd5f50cc14ddf93acdcc6e6f74c3e468f95f1bcaf3d3ebf3a
SSDEEP 98304:WMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMM:z
TLSH
T155177CC2F10291D2EB0D0431842F0FB41697BD525A6A694E3662FF1BAF73185AD5E23F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	angle.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msmsgs.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.eXe

Disables RegEdit via registry modification 4 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	msmsgs.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	angle.eXe

Executes dropped EXE 4 IoCs

pid	Process
2616	svchost.eXe
1844	svchost.eXe
576	msmsgs.eXe
3636	angle.eXe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RCX842F.tmp	svchost.eXe
File created	C:\Windows\SysWOW64\angle.eXe	angle.eXe
File created	C:\Windows\SysWOW64\angle.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File created	C:\Windows\SysWOW64\angle.eXe	svchost.eXe
File created	C:\Windows\SysWOW64\angle.eXe	msmsgs.eXe
File opened for modification	C:\Windows\SysWOW64\angle.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\RCX4BEC.tmp	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\angle.eXe	svchost.eXe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RCX842F.tmp	svchost.eXe
File opened for modification	C:\Windows\svchost.eXe	angle.eXe
File opened for modification	C:\Windows\RCXB62C.tmp	angle.eXe
File opened for modification	C:\Windows\ziprar.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\svchost.eXe	svchost.eXe
File created	C:\Windows\svchost.eXe	svchost.eXe
File created	C:\Windows\svchost.eXe	msmsgs.eXe
File created	C:\Windows\svchost.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\svchost.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\RCX4B3F.tmp	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File created	C:\Windows\ziprar.eXe	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
File opened for modification	C:\Windows\RCX5B30.tmp	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	angle.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msmsgs.eXe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "190"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
576	msmsgs.eXe
576	msmsgs.eXe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	msmsgs.eXe
Token: SeShutdownPrivilege	576	msmsgs.eXe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
2616	svchost.eXe
2616	svchost.eXe
1844	svchost.eXe
1844	svchost.eXe
576	msmsgs.eXe
576	msmsgs.eXe
3636	angle.eXe
3636	angle.eXe
576	msmsgs.eXe
3640	LogonUI.exe
2616	svchost.eXe
1844	svchost.eXe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 760	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	81
PID 1828 wrote to memory of 1636	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	83
PID 1828 wrote to memory of 2616	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	85
PID 1828 wrote to memory of 1844	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	86
PID 1828 wrote to memory of 576	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	87
PID 1828 wrote to memory of 3636	1828	2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe	88
PID 1844 wrote to memory of 1416	1844	svchost.eXe	89
PID 2616 wrote to memory of 2972	2616	svchost.eXe	90
PID 576 wrote to memory of 1016	576	msmsgs.eXe	93
PID 2616 wrote to memory of 1496	2616	svchost.eXe	95
PID 576 wrote to memory of 1664	576	msmsgs.eXe	96
PID 1844 wrote to memory of 5064	1844	svchost.eXe	99
PID 3636 wrote to memory of 580	3636	angle.eXe	101
PID 576 wrote to memory of 2388	576	msmsgs.eXe	103
PID 3636 wrote to memory of 3448	3636	angle.eXe	105

C:\Users\Admin\AppData\Local\Temp\2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_5bccd6ba8947f9588474ff3b5cf1c502_elex_wannacry.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:760
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636
- C:\Users\Public\Pictures\svchost.eXe
  "C:\Users\Public\Pictures\svchost.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496
- C:\Users\Public\Music\svchost.eXe
  "C:\Users\Public\Music\svchost.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1016
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
- C:\Windows\SysWOW64\angle.eXe
  "C:\Windows\system32\angle.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Surat Buat Presiden.htm

Path C:\Surat Buat Presiden.htm
Size 656B
SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
MD5 e0722dddd4442be2d33a6948b7c8d04d
SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
TLSH
T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
MD5 SHA1 SHA512 TLSH

Submit Download

RCX84BB.tmp

Path C:\Users\Public\Music\RCX84BB.tmp
Size 562KB
SHA256 5b4907bc48869fad9c625dbeb11f8bb9d12dcc7e2bd2028f4b03a5ebe4333379
MD5 00b94400abd67a952b61b9a879c5ad83
SHA1 3bf484cc6b640199774941ca6f2fb3f826b22bba
SHA512 a105ced03b6db043e2e5dc8547f66c174db5f86453a52277d1edc28af04e526bc5838982b6089621f4f16d2b32f5ab6fdbf344120866da53a3d0183c7528ea44
SSDEEP 3072:aGC43DksD+XZVpay00000000000000000000000000000000000000000000000v:aGC43NaVY3rrrrrrrrrrl
TLSH
T121C419D5B68253A3DB410531E01F0FB8226E6DD7804EA815A3E3BB534B761099DED2BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.eXe

Path C:\Users\Public\Pictures\svchost.eXe
Size 18.5MB
SHA256 a54c6b94af36931362f0cdf6c30baf510c23a9c6f31b7df737b6ffafaf036bf0
MD5 5bccd6ba8947f9588474ff3b5cf1c502
SHA1 b636ef422f54113fcd0e8f6deb9ac9ea001e77bd
SHA512 cb33f46c1844baf675c471a477b74fc7b548d8e3c432856600e988dfacf4660ae5db532535dd6eebd5f50cc14ddf93acdcc6e6f74c3e468f95f1bcaf3d3ebf3a
SSDEEP 98304:WMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMOMMM:z
TLSH
T155177CC2F10291D2EB0D0431842F0FB41697BD525A6A694E3662FF1BAF73185AD5E23F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4B3F.tmp

Path C:\Windows\RCX4B3F.tmp
Size 556KB
SHA256 778b3db1d6397f2b23a60c01d9edc5efbeeb803d6723fd900d4606b9788fcaae
MD5 615f4de330b4fe8371ca065a30eb35bb
SHA1 86e9756d066958443fc859bb70e569fe77588c25
SHA512 5b38ecadf243633c71b93a375b614888451fd791fa7b2a6edae9cd639f148108bf01fd7a5811d65113d3d37fc0db4b701923d19dbd8a3a1ae7d3194488fc34cd
SSDEEP 6144:+GC43NaVdhhhhhhhhwr8MMtjyhX9+Fb/rrrrrrrrrr5:+Afr8MMPF
TLSH
T1BEC47CC2F14291D2EB0D0431842F0FB41697BD525A6A294E3662FF1BAF73185AD5E23F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads